# Moonwell Loses About $8.7 Million on Base After an Attacker Inflated the Price of Its Own Collateral Token

Security researchers published a reproducible proof of concept showing the loss resulted from a price oracle accurately reading a thin market, not from a defect in Moonwell's lending contracts.

- Published: 2026-08-28T05:39:41.604Z
- Canonical: https://polylog.news/crypto/2026-08-28/moonwell-loses-about-8-7-million-on-base-after-an-attacker-i
- Publisher: Polylog (Crypto desk)
- Section: crypto
- Sources: [DeFiHackLabs](https://github.com/SunWeb3Sec/DeFiHackLabs/commit/48aac2435bc5a9beeec6f8686ff9add420133243), [DeFiHackLabs (proof of concept)](https://github.com/SunWeb3Sec/DeFiHackLabs/commit/716c638370e275259eaa0444401f8b9513ea54d5), [Rekt News](https://www.rekt.news/)

The lending protocol Moonwell lost roughly $8.7 million on Base on August 27 after an attacker manipulated the market price of MAMO, a thinly traded token accepted as collateral in one of its markets. The security firms CertiK and PeckShield put the loss near that figure. The attacker pushed MAMO's price up sharply, borrowed against the inflated collateral value, and left with liquid assets including cbBTC, USD Coin, wrapped staked ether and ether.

The mechanism is now documented in code. The DeFiHackLabs repository, which maintains executable reproductions of on-chain incidents, published a proof of concept on August 28 labeled [Chainlink oracle-source price manipulation of MAMO](https://github.com/SunWeb3Sec/DeFiHackLabs/commit/48aac2435bc5a9beeec6f8686ff9add420133243), and a [second commit](https://github.com/SunWeb3Sec/DeFiHackLabs/commit/716c638370e275259eaa0444401f8b9513ea54d5) adding the same test to the collection. The distinction matters. The price feed did not fail: it reported exactly what the market it was reading showed. The failure was the decision to let a token with shallow liquidity secure loans backed by deep liquidity.

Moonwell said it was investigating the affected MAMO market and restricted further borrowing on Base. Several outlets reported that the loss exceeds the protocol's annual revenue and that it is the third security failure at Moonwell inside eleven months. Moonwell has not published a full technical postmortem, and no attribution has been made public.

This fits a recurring pattern in 2026 losses. Audits typically scope the smart-contract code itself. The money is instead leaving through components that operate alongside that code and behave exactly as designed: oracle price feeds, collateral listings, governance keys. Base holds $5.48 billion in decentralized finance (DeFi) value according to DeFiLlama, and its lending markets compete by listing as many tokens as possible, the same competitive pressure that put an illiquid token into a collateral slot in the first place. [Rekt News](https://www.rekt.news/) has documented the same category of failure across other protocols this year.

## What this means

Every lending protocol that lists a long tail of small tokens as collateral carries the same exposure, because the cost of moving a thin market is far below the value of the liquid assets that can be borrowed against it. Depositors in the borrowable assets absorb the loss, not the holders of the manipulated token. The direct consequence is tighter collateral policy across Base and other low-fee chains: fewer listed assets, lower loan-to-value ratios, and caps on how much can be borrowed per market. That reduces the yield those protocols can advertise and pushes deposits toward the largest venues.

## What to watch

- Whether Moonwell publishes a postmortem naming the specific oracle configuration, since without it other protocols using similar feeds cannot check their own exposure.
- Whether oracle providers add liquidity-depth conditions to feeds used for collateral pricing, which would move the safeguard from each protocol to the data layer.
- Whether lending markets on Base delist or cap small-capitalization collateral in the coming weeks, a direct read on whether the industry treats this as a Moonwell failure or a category failure.