An attacker burned $3.8M in MAMO slippage to borrow $10M of Moonwell depositors' assets

The mechanism deserves precision, because it decides what actually gets fixed. Nothing here needed a broken contract: the attacker bought roughly $7 million of a thinly traded token, MAMO went from about $0.0105 to nearly $0.088, and the oracle published that figure because for a few blocks it was the figure ^[16][2]. Against the swollen collateral, about $10 million of real assets left the protocol and did not come back ^[17]. The $3.8 million surrendered on the round trip through MAMO was the entry fee, and $10 million out for $3.8 million in is a 2.6-times return on slippage ^[20], which is the ratio a risk committee is really underwriting whenever it approves a long-tail market, since a borrow cap protects depositors only while it sits below the cost of moving the price.

The remedy points at the same place. Moonwell cut the MAMO borrowing limit to 1 wei and lowered supply caps on MAMO and its own WELL token ^[7], and a parameter that can be set to effectively zero after the loss could have been set there before it. A protocol whose last nine months contain three incidents ^[8] is spending its governance bandwidth on caps and post-mortems instead of new markets, which is the durable cost of the listing rather than the headline one.

The counter-reading sits in February, when a misconfigured cbETH oracle reported about $1.12 for an asset worth roughly $2,200, an understatement of about 1,964 times, and left $1.78 million of bad debt ^[10][13]. That is a configuration failure a bounds check catches, and it is the incident that drew the argument about AI-assisted coding, since the relevant commits listed Anthropic's Claude Opus 4.6 as a co-author, per Cryptopolitan ^[11]. So "third oracle failure" bundles two problems with two different owners: November's spot-price manipulation ^[9] and Wednesday's belong to whoever approved the collateral.

Scaled against the balance sheet, $4 million to $9 million is 5.5% to 12.4% of the $72.77 million DeFiLlama shows locked in Moonwell ^[15][6][12], and adding February's shortfall puts nine months of disclosed losses at 7.9% to 14.8% of everything currently on deposit ^[14]. Interest spreads on an illiquid governance-adjacent market do not fund that.

WELL spiked about 25% on the news before correcting roughly 13% to around $0.0032 ^[5], so whatever the first hour was pricing, it was not the bad debt. The spread among observers is instructive too, or rather its composition is: Blockaid counted 50.6 cbBTC and ExVul 71.36, about 41% more units ^[18][19][21], a disagreement about how many transactions had cleared and not about what bitcoin costs. This is probably wrong in one specific way, and it is the way to check it: if the post-mortem shows a time-weighted or depth-aware feed was available and the market was pointed at spot anyway, then the failure is implementation and the listing thesis loses. By then the attacker's wallet held just over $4,600 ^[4], which is what a finished exit looks like.