Moola Market hack — October 2022

On 18 October 2022 an attacker drained the Celo-based lending protocol Moola Market by inflating the price of its own governance token, MOO, and borrowing against it.

The Block Research's Igor Igamberdiev traced the sequence: the attacker started with 243,000 CELO from Binance, lent 60,000 CELO to Moola to borrow 1.8 million MOO, then used the remaining CELO to pump the price of MOO, and used the borrowed MOO as inflated collateral to borrow further assets. AnChain describes the same loop, noting that the lending contract used real-time prices and that MOO rose from about 0.02 to 0.73 CELO before liquidity was drained. Cointelegraph puts the inflation at about 6,400% on a starting outlay of roughly $45,000.

The size of the loss is disputed because the stolen MOO is hard to value at a price the attack itself created. The Block's itemisation - 8.8 million CELO ($6.5m), 765,000 cEUR ($700k), 1.8 million MOO ($600k) and 644,000 cUSD ($600k) - totals about $8.4 million. Cointelegraph and AnChain value the same haul at about $9.1 million, mainly by pricing the MOO higher. CoinDesk reported the loss as over $10 million without an itemised breakdown, which sets the upper bound recorded here.

Moola paused the protocol, said it discovered the issue at 16:54 UTC and contacted law enforcement, and publicly invited the attacker to make contact. The attacker did, and after negotiation returned 93.1% of the funds to Moola's governance multisig, according to CoinDesk roughly twelve hours after the attack, though Cointelegraph puts the return within about five hours of the exploit being confirmed. Estimates of what the attacker kept also differ: Cointelegraph says about $500,000, while AnChain computes the retained share at roughly $637,000.