Moonwell (MAMO Core Market) hack — August 2026
Incident facts
| Date of incident | |
|---|---|
| Target type | Lending protocol |
| Loss | $9,131,000Published estimates range $8,700,000 to $11,028,762Price at time of incident |
| Method | Oracle or price manipulationThe price of the thinly traded MAMO token was pushed up roughly fortyfold and direct token transfers inflated the mToken exchange rate, then the collateral was borrowed against for real cbBTC, WETH, USDC and wstETH |
| Chains | Base |
| Outcome | Unresolved |
What happened
Moonwell's MAMO Core Market on Base was drained between 06:09:45 and 09:30:13 UTC on 27 August 2026. Moonwell's post-mortem, published the next day, puts the gross value borrowed at $11,028,762 and the debt left unpaid after liquidations at about $9.131m. That bad debt is the figure recorded here.
No contract was broken. MAMO is thinly traded, and the attacker bought about $7.50m of it until the source feed the protocol used for collateral read $0.43127363 against an opening $0.010597, roughly fortyfold; the highest price the market actually accepted was $0.40248571. On top of 15,089,595 MAMO supplied in the normal way, another 53.39m MAMO were transferred straight into the market contract without minting, which lifted the mToken exchange rate about 3.68 times and enlarged the position further. Against that collateral the attacker borrowed 71.36 cbBTC, 623.6 WETH, 2.56m USDC and 368 wstETH.
Liquidators then worked through 595 liquidation events and seized essentially all of the attacker's mMAMO, repaying part of the debt and leaving roughly $9.131m outstanding. The operation had been funded with 800.098 ETH withdrawn from Tornado Cash between 21 and 23 August. The proceeds left Base as 8,729,453.83 USDC through CCTP v2 via Wormhole and were converted into 8,728,318.99 DAI on Ethereum. The post-mortem estimates the attacker's net gain, after the capital put in, at $6,784,655.
Moonwell set borrow caps for every Core Market on Base to 1 wei, halting new borrowing, and did the same for MAMO and WELL supply caps. Compensation for suppliers is going through governance, and no plan had been adopted at the time of writing.
CertiK and PeckShield put the loss at about $8.7m on the day, close to the USDC that was bridged out; the range here runs from that figure to the gross amount borrowed. This is the third oracle-pricing failure recorded against Moonwell, after the wrsETH feed in November 2025 and the cbETH misconfiguration in February 2026. The earlier two were bad prices reported to the protocol; this one is a real price moved by an attacker in a market too thin to defend.
Sources
- The BlockSecondary · retrieved 2026-09-10
- The Crypto TimesSecondary · retrieved 2026-09-10
- CoinpediaSecondary · retrieved 2026-09-10
- Moonwell post-mortem, governance forumPrimary · retrieved 2026-09-10
Official post-mortem: https://forum.moonwell.fi/t/post-mortem-mamo-market-incident-on-base/2208
Changes to this entry
- Recorded the same day as the incident, while it was still developing. The $8.7m figure is the CertiK and PeckShield estimate; one outlet reported approximately $9m and another quoted a higher peak MAMO price than the roughly eightfold move used here. Both the amount and the price detail will be corrected against Moonwell's post-mortem when it appears.
- Amount changed from $8,700,000 to $9,131,000, with a range from $8.7m to $11,028,762, following Moonwell's post-mortem of 28 August: $11,028,762 gross borrowed, about $9.131m of debt left after liquidations, and an estimated $6,784,655 net gain to the attacker. The same-day $8.7m from CertiK and PeckShield is kept as the low end. The MAMO price move was previously described as roughly eightfold; the post-mortem's source feed rose from $0.010597 to $0.43127363, roughly fortyfold, and the summary and vector detail are corrected. The post-mortem is added as a primary source.
Cite this
This data is published under CC BY 4.0. You may reuse it, including commercially, as long as you credit iTokenly and link back.
iTokenly Hack Registry, "Moonwell (MAMO Core Market) hack — August 2026", iTokenly, accessed 2026-10-11, https://itokenly.com/hacks/moonwell-mamo-markethttps://itokenly.com/hacks/moonwell-mamo-marketPermalinks never change. If an entry is renamed, the old address keeps working.
Spotted an error? Write to [email protected]. Corrections to published figures are logged on this page. See the methodology for how entries are checked.