Moonwell exploit leaves $8.7 million in DAI as onchain evidence grows

Moonwell also set the MAMO and WELL supply caps to 1 wei, while saying other supply caps were unchanged. That effectively stops new borrowing in the affected Base markets while existing depositors retain the ability to withdraw, based on the protocol's stated precautionary action.

What is confirmed

PeckShield and CertiK estimated losses at about $8.7 million. Blockaid separately reported an initial observed impact of more than 50.6 cbBTC, worth more than $4 million at the time, from Moonwell's mCBTC market. Those are incident estimates and observed transfers, not a final audited loss figure.

A public onchain review traced 8,728,318.997396 DAI received on Ethereum by 0xD71d…C384 in transaction 0x58399aaf…4125d. The review also identified a Base transaction in which 7,407,608.308454132 MAMO reached the same address after a 75,000 USDC KyberSwap route. Those transfers are confirmed onchain; describing the price movement as manipulation remains an analytical conclusion until the pool events are reconstructed.

The security firms described a price-manipulation path: the attacker moved the price of the relatively illiquid MAMO token, used the inflated value as collateral and borrowed more liquid assets including cbBTC. A representative Base transaction is publicly indexed at 0xafb6…798f. The reported proceeds were later consolidated in DAI at 0xD71d…C384.

Still unresolved

Moonwell had not published a final postmortem or accounting of the incident in the material reviewed for this report. The protocol's emergency cap changes confirm the operational response; the precise final loss, recovery prospects and any remediation plan remain open questions.