Another day, another Moonwell exploit. 4th major incident in 3 years.
.
@MoonwellDeFi, a Compound Finance v2 fork (with features like borrow/supply caps, cross-chain governance, and multi-token emissions), and a decentralized lending and borrowing protocol deployed on
@base and
@Optimism, has lost ~292 ETH (~$1.01M) in a price manipulation exploit earlier today.
The exploit targeted Moonwell's lending contracts, specifically involving wrapped restaked ETH (wrstETH and wstETH) markets.
Here's what our preliminary investigation found:
An off-chain oracle caused an asset price fluctuation, that resulted the attacker to borrow 20 mwstETH.
(
basescan.org/address/0x627fe…)
against 0.0000207 wrstETH via a flash loan from the CLpool.
(
basescan.org/address/0xedfa2…)
Flash Loan TX (Base):
(
basescan.org/address/0x14dcc…)
1.) This minuscule amount was deposited as collateral into Moonwell.
2.) Due to the oracle malfunction, the protocol valued this tiny collateral at millions of dollars.
3.) The attacker borrowed over 20 mwstETH per transaction against the artificially inflated collateral.
4.) Borrowed assets were liquidated or swapped for profit.
5.) The initial flash loan was repaid within the same block, avoiding liquidation.
6.) This cycle was executed repeatedly to drain 292-295 ETH.
A Pattern:
1.) Oct 10, 2025: $1.7M oracle/DEX security incident.
2.) Nov 4, 2025: $1.01M oracle exploit (today).
24 days apart.
3.) Dec 2024: $320K flash loan exploit.
4.) 2022: Nomad bridge exposure lead to a bad debt scenario.
Total: 4 exploits, $2.7M lost in 2 months alone.
interestingly, Moonwell removed its bug bounty on
@immunefi earlier this year in Feb, 2025, just months before suffering two major exploits.
The Moonwell (
#WELL) fell 13.48% over the last 24h, underperforming the broader crypto market (-3.95%), and currently holds a TVL of $137,236,306.
If you're a lender/borrower on Moonwell, verify your collateral via the app. Revoke unnecessary approvals using
@RevokeCash.