Moonwell MAMO Market Exploit

What happened

On 27 August 2026, between 06:09:45 and 09:46:25 UTC, an attacker inflated the price of MAMO on Moonwell's Base deployment and borrowed against the inflated collateral, taking 71.36 cbBTC, 623.60 WETH, 2,560,000 USDC and 368 wstETH, $11,028,762 in all. PeckShield and CertiK put the attacker's proceeds at about $8.7m, aggregated in DAI on Ethereum; the postmortem by Anthias Labs estimates the net gain at $6,784,655 against roughly $1.947m of capital deployed, seeded from about 799 ETH, with residual bad debt of about $9.131m.

No code was hacked. The attacker supplied 15,089,595 MAMO for mMAMO receipt tokens, direct-transferred 53,393,290 MAMO to the mMAMO contract without minting, inflating the exchange rate about 3.68x, then bought roughly 94.31m MAMO through thin DEX liquidity, driving MAMO from $0.010597 to a peak of $0.43127363 before borrowing. 8,729,453 USDC was burned on Base and 8,728,318 USDC received on Ethereum, then converted to DAI at an address beginning 0xD71d, which the postmortem names as the attacker's linked operational account; SlowMist's database logs the incident at $8,790,000. Moonwell cut borrow caps on all Base Core Markets to 1 wei at 10:53:43 UTC and the MAMO supply cap to 1 wei at 11:09:43, and 595 liquidation events across 594 transactions seized close to 100 per cent of the attacker's minted mMAMO. The Anthias Labs postmortem, published on the governance forum on 28 August, carries no reimbursement decision. It is Moonwell's third incident in ten months, after the November 2025 wrsETH oracle bug and a March 2026 governance attack.