Moonwell MAMO manipulation enables US$11.03 million borrowing; supplier recovery remains unresolved
An attacker used inflated MAMO collateral to borrow US$11.03 million from Moonwell on Base, leaving about US$9.13 million in debt after liquidations. Supplier recovery remains unresolved. Check affected positions with Moonwell before adding funds.
If you supplied funds to Moonwell on Base, directly or through Mamo, check your position and available withdrawals through the official service and ask support about your market’s recovery status. Avoid adding funds until you understand the remaining debt and withdrawal restrictions; there is no device update to install.
What’s happening
On 27 August 2026, an attacker manipulated the thinly traded MAMO token’s price and Moonwell’s collateral accounting on Base, making the position appear valuable enough to support US$11.03 million in borrowing. The borrowed assets were cbBTC, WETH, USDC and wstETH. BlockSec estimated the resulting loss at about US$9.1 million; the official post-mortem describes that figure as remaining borrower debt and potential bad debt after liquidations, rather than the total borrowed. People supplying funds to the affected lending markets faced exposure and withdrawal-liquidity problems. Moonwell restricted borrowing and MAMO deposits and engaged recovery specialists. Certora’s November review reports roughly US$246,000 in reserve-funded USDC debt repayments and removal of MAMO’s borrowing power, while supplier recovery remained ongoing. Those reserve payments are not recovery of stolen funds. The reviewed sources do not establish full supplier repayment or restored unrestricted withdrawals by 3 November.
- What
- Breach
- Affects
- Moonwell lending markets on Base, including the MAMO collateral market
- Fixed in
- Nothing to patch
- Since
- 27 Aug 2026
Timeline
- Update
Certora reported that MIP-X66 had executed in early September, applying about US$246,000 of protocol reserves to USDC bad debt. Its status review, dated 28 October, said Base borrowing and MAMO deposits remained effectively blocked and supplier recovery was still in progress.
- Update
Certora’s subsequent review reports that MIP-X69 reduced MAMO’s collateral factor on Base to 0%, removing its borrowing power.
- Update
Moonwell said it had retained Zero Shadow to assist recovery and that MIP-X66 was in its vote collection period, according to CryptoSlate. The proposal covered reserve-funded USDC debt repayments and lower debt-interest accrual; no supplier repayment timetable was announced.
- Made public
Anthias Labs published its post-mortem, estimating US$9.131 million in remaining debt after liquidations. It traced approximately 8.728 million DAI to a linked attacker account, where it remained when checked on 28 August.
- Update
Moonwell reduced Base borrow caps to 1 wei, effectively stopping new borrowing. At 11:09 UTC, it also reduced the MAMO supply cap to 1 wei, effectively stopping new deposits into that market.
- UpdateNothing to patch
An attacker manipulated MAMO’s price and collateral valuation on Moonwell’s Base deployment, borrowing US$11,028,762 across cbBTC, WETH, USDC and wstETH in 18 loans.
Sources
- Post-Mortem: MAMO Market Incident on BaseAnthias Labs / Moonwell Governance Forum · 28 Aug 2026
- MIP-X66: Urgent Risk and Reserve RecsMoonwell
- Newsletter - August 2026BlockSec · 1 Sept 2026
- DeFi lender proposes bad-debt fix, but user USDC funds remain lockedCryptoSlate · 7 Sept 2026
- The Moonwell Exploit: An $8.7M Attack That Bypassed a Supply CapCertora · 2 Nov 2026