{"id":"moonwell-mamo-collateral-theft-aug-2026","category":"breach","status":"live","title":"Moonwell MAMO manipulation enables US$11.03 million borrowing; supplier recovery remains unresolved","tldr":"An attacker used inflated MAMO collateral to borrow US$11.03 million from Moonwell on Base, leaving about US$9.13 million in debt after liquidations. Supplier recovery remains unresolved. Check affected positions with Moonwell before adding funds.","summary":"On 27 August 2026, an attacker manipulated the thinly traded MAMO token’s price and Moonwell’s collateral accounting on Base, making the position appear valuable enough to support US$11.03 million in borrowing. The borrowed assets were cbBTC, WETH, USDC and wstETH. BlockSec estimated the resulting loss at about US$9.1 million; the official post-mortem describes that figure as remaining borrower debt and potential bad debt after liquidations, rather than the total borrowed. People supplying funds to the affected lending markets faced exposure and withdrawal-liquidity problems. Moonwell restricted borrowing and MAMO deposits and engaged recovery specialists. Certora’s November review reports roughly US$246,000 in reserve-funded USDC debt repayments and removal of MAMO’s borrowing power, while supplier recovery remained ongoing. Those reserve payments are not recovery of stolen funds. The reviewed sources do not establish full supplier repayment or restored unrestricted withdrawals by 3 November.","action":"If you supplied funds to Moonwell on Base, directly or through Mamo, check your position and available withdrawals through the official service and ask support about your market’s recovery status. Avoid adding funds until you understand the remaining debt and withdrawal restrictions; there is no device update to install.","product":"Moonwell lending markets on Base, including the MAMO collateral market","audience":"home","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["moonwell","mamo","base","crypto-theft","defi","oracle-manipulation"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"advisory","title":"Post-Mortem: MAMO Market Incident on Base","url":"https://forum.moonwell.fi/t/post-mortem-mamo-market-incident-on-base/2208","by":"Anthias Labs / Moonwell Governance Forum","date":"2026-08-28"},{"kind":"advisory","title":"MIP-X66: Urgent Risk and Reserve Recs","url":"https://github.com/moonwell-fi/moonwell-contracts-v2/blob/main/proposals/mips/mip-x66/x66.md","by":"Moonwell","date":""},{"kind":"research","title":"Newsletter - August 2026","url":"https://blocksec.com/blog/defi-security-incidents-cosmos-evm-moonwell","by":"BlockSec","date":"2026-09-01"},{"kind":"news","title":"DeFi lender proposes bad-debt fix, but user USDC funds remain locked","url":"https://cryptoslate.com/lending-protocol-offers-bad-debt-fix-while-trapped-depositors-face-missing-usdc-funds-and-zero-cash-access/","by":"CryptoSlate","date":"2026-09-07"},{"kind":"research","title":"The Moonwell Exploit: An $8.7M Attack That Bypassed a Supply Cap","url":"https://www.certora.com/blog/moonwell-exploit-supply-cap-bypass-attack","by":"Certora","date":"2026-11-02"}],"started":"2026-08-27","closed":null,"created":"2026-11-03T21:57:00.660Z","updated":"2026-11-03T21:57:00.660Z","cve_notes":[],"timeline":[{"at":"2026-11-02","added":"2026-11-03T21:54:09.841Z","kind":"other","text":"Certora reported that MIP-X66 had executed in early September, applying about US$246,000 of protocol reserves to USDC bad debt. Its status review, dated 28 October, said Base borrowing and MAMO deposits remained effectively blocked and supplier recovery was still in progress.","url":"https://www.certora.com/blog/moonwell-exploit-supply-cap-bypass-attack","by":"Certora","patch":null},{"at":"2026-10-17","added":"2026-11-03T21:54:09.841Z","kind":"other","text":"Certora’s subsequent review reports that MIP-X69 reduced MAMO’s collateral factor on Base to 0%, removing its borrowing power.","url":"https://www.certora.com/blog/moonwell-exploit-supply-cap-bypass-attack","by":"Certora","patch":null},{"at":"2026-09-04","added":"2026-11-03T21:54:09.841Z","kind":"other","text":"Moonwell said it had retained Zero Shadow to assist recovery and that MIP-X66 was in its vote collection period, according to CryptoSlate. The proposal covered reserve-funded USDC debt repayments and lower debt-interest accrual; no supplier repayment timetable was announced.","url":"https://cryptoslate.com/lending-protocol-offers-bad-debt-fix-while-trapped-depositors-face-missing-usdc-funds-and-zero-cash-access/","by":"CryptoSlate","patch":null},{"at":"2026-08-28","added":"2026-11-03T21:54:09.841Z","kind":"disclosed","text":"Anthias Labs published its post-mortem, estimating US$9.131 million in remaining debt after liquidations. It traced approximately 8.728 million DAI to a linked attacker account, where it remained when checked on 28 August.","url":"https://forum.moonwell.fi/t/post-mortem-mamo-market-incident-on-base/2208","by":"Anthias Labs / Moonwell Governance Forum","patch":null},{"at":"2026-08-27T10:53Z","added":"2026-11-03T21:54:09.841Z","kind":"other","text":"Moonwell reduced Base borrow caps to 1 wei, effectively stopping new borrowing. At 11:09 UTC, it also reduced the MAMO supply cap to 1 wei, effectively stopping new deposits into that market.","url":"https://forum.moonwell.fi/t/post-mortem-mamo-market-incident-on-base/2208","by":"Anthias Labs / Moonwell Governance Forum","patch":null},{"at":"2026-08-27","added":"2026-11-03T21:54:09.841Z","kind":"other","text":"An attacker manipulated MAMO’s price and collateral valuation on Moonwell’s Base deployment, borrowing US$11,028,762 across cbBTC, WETH, USDC and wstETH in 18 loans.","url":"https://forum.moonwell.fi/t/post-mortem-mamo-market-incident-on-base/2208","by":"Anthias Labs / Moonwell Governance Forum","patch":"na"}],"url":"https://hard.fyi/live/moonwell-mamo-collateral-theft-aug-2026/","json":"https://hard.fyi/api/live?id=moonwell-mamo-collateral-theft-aug-2026"}