DeFi Protocol Moonwell Loses $1.78M in Exploit
DeFi lending protocol Moonwell was exploited for $1.78 million after a critical mispricing in its cbETH oracle. The oracle returned a price of $1.12 for Coinbase Wrapped Staked ETH instead of its actual value of around $2,200. The incident allowed attackers to borrow assets against artificially cheap collateral, draining liquidity from the protocol.
- The misconfiguration occurred on February 15, 2026, when a governance proposal, MIP-X43, was executed. The error caused the oracle to use only the raw cbETH/ETH exchange rate instead of multiplying it by the ETH/USD price to get the correct dollar value. - Within minutes of the flawed proposal's execution, liquidation bots began seizing collateral, acquiring 1,096.317 cbETH by repaying only about $1 in debt for each token valued at approximately $2,200. - The Moonwell team responded four minutes after the incident began by reducing the supply and borrow caps for the cbETH market to just 0.01, which prevented new borrowing but could not halt the ongoing liquidations. Correcting the oracle required a 5-day governance voting and timelock period, which could not be bypassed. - This is not the first oracle-related incident for the protocol; in November 2025, a Chainlink oracle malfunction caused a different asset to be massively inflated, leading to a $1 million loss and leaving the protocol with $3.7 million in bad debt. - Security auditors publicly noted that the code for the affected contracts showed multiple commits co-authored by Anthropic's AI model, Claude Opus 4.6, raising concerns about the risks of AI-assisted development in DeFi. - The protocol operates on the Base and Optimism networks and partners with the risk management firm Gauntlet for services like optimizing capital efficiency and setting risk parameters such as supply caps.
