Moonwell (MAMO Core Market) hack — August 2026
Incident facts
| Date of incident | |
|---|---|
| Target type | Lending protocol |
| Loss | $8,700,000Price at time of incident |
| Method | Oracle or price manipulationThe price of the thinly traded MAMO token was pushed up roughly eightfold, then the inflated collateral was borrowed against for real cbBTC, USDC, wstETH and ETH |
| Chains | Base |
| Outcome | Unresolved |
What happened
Moonwell's MAMO Core Market on Base was drained on the morning of 27 August 2026, with the first alerts around 09:35 UTC. CertiK and PeckShield independently put the loss near $8.7m.
No contract was broken. MAMO is thinly traded, and the attacker bought and traded it until the price the protocol used for collateral had risen roughly eightfold, from about $0.0105. That inflated valuation supported borrowing far more than the token could ever have been sold for, and the attacker took out real assets against it: cbBTC, USDC, wstETH and ETH. Direct token transfers into the market contracts pushed the mToken exchange rate up further and enlarged the position. The proceeds were consolidated on Ethereum and converted to DAI.
Moonwell set borrow caps for every Core Market on Base to 1 wei, halting new borrowing, and did the same for MAMO and WELL supply caps. It said it was investigating and would share updates; no post-mortem had been published at the time of recording, and it did not respond to press enquiries. WELL fell about 13% and MAMO about 9% over the following day.
This is the third oracle-pricing failure recorded against Moonwell, after the wrsETH feed in November 2025 and the cbETH misconfiguration in February 2026. The earlier two were bad prices reported to the protocol; this one is a real price moved by an attacker in a market too thin to defend.
Sources
- The BlockSecondary · retrieved 2026-08-27
- The Crypto TimesSecondary · retrieved 2026-08-27
- CoinpediaSecondary · retrieved 2026-08-27
Changes to this entry
- Recorded the same day as the incident, while it was still developing. The $8.7m figure is the CertiK and PeckShield estimate; one outlet reported approximately $9m and another quoted a higher peak MAMO price than the roughly eightfold move used here. Both the amount and the price detail will be corrected against Moonwell's post-mortem when it appears.
Cite this
This data is published under CC BY 4.0. You may reuse it, including commercially, as long as you credit iTokenly and link back.
iTokenly Hack Registry, "Moonwell (MAMO Core Market) hack — August 2026", iTokenly, accessed 2026-08-27, https://itokenly.com/hacks/moonwell-mamo-markethttps://itokenly.com/hacks/moonwell-mamo-marketPermalinks never change. If an entry is renamed, the old address keeps working.
Spotted an error? Write to [email protected]. Corrections to published figures are logged on this page. See the methodology for how entries are checked.