Moonwell caps Base borrows after $8.7M MAMO oracle exploit

Moonwell restricted borrowing across all Core Markets on the Base network after an attacker manipulated the on-chain price oracle for the low-liquidity MAMO token and withdrew roughly $8.7 million. The protocol set borrow caps to 1 wei and reduced supply caps for MAMO and WELL to 1 wei while leaving other supply caps unchanged.

Blockchain security firms Peckshield, Certik and Blockaid reported that the exploit unfolded in three phases: the attacker inflated MAMO’s oracle price, used the inflated token as collateral to borrow higher-value assets including wrapped bitcoin on Base (cbBTC), and then converted those assets into DAI before consolidating proceeds into a single wallet.

Moonwell posted that it is aware of an issue affecting the MAMO Core Market on Base and is actively investigating. The protocol said teams are running audits and preparing technical post-mortems. Moonwell implemented the temporary caps to prevent new borrowing without pausing contract operations entirely.

Asset manager Zyfai reported that its automated agents began rebalancing capital out of affected Morpho vaults before the exploit escalated and that it disabled all Moonwell-managed Morpho vaults as a precaution. Zyfai noted its risk system, which monitors on-chain metrics and off-chain signals, registered converging risk flags and triggered rebalancing while notifying quant teams to halt Moonwell-related yield strategies. Zyfai confirmed user funds remain secure.

The exploit pushed down token prices: MAMO and Moonwell’s WELL token each fell about 15% after the event. Security teams are conducting a detailed review of the contracts and oracle feeds involved and expect to publish more complete technical findings after audits finish.

The incident highlights the vulnerability of low-liquidity tokens when they are used as collateral tied to on-chain price oracles. Moonwell and third-party auditors are examining on-chain traces and contract behavior to determine exact mechanics and to recommend changes to oracle and collateral settings. Users are advised to follow official protocol communications for updates.