Moonwell $8.7M mMAMO Exchange Rate Inflation Exploit (Explained)

On August 27, 2026, an attacker inflated the exchange rate behind Moonwell's MAMO market by donating tokens directly into the mMAMO contract rather than depositing through it, then pumped MAMO's price on thin liquidity to multiply the effect. No key was stolen and no contract was hacked, the market just valued fake collateral at a real price. The attacker borrowed $11 million against it and moved $8.7 million off Base as DAI before liquidations caught up.

Protocol Background

Moonwell's MAMO market works like any Compound-style lending market, deposit MAMO, receive mMAMO receipt tokens, and the mMAMO-to-MAMO exchange rate tracks how much underlying MAMO backs each share. Moonwell prices a position by multiplying mMAMO shares held by that exchange rate, then by MAMO's oracle price, to get a collateral value that sets how much a wallet can borrow. MAMO had been listed under MIP-B48 with a 50% collateral factor, a 20,000,000 MAMO supply cap on new mints, and a 3,000,000 MAMO borrow cap.

Hack Analysis

The attack was funded through Tornado Cash. The linked account, 0xd71dd9b6e634412713c47fe7ae02c628e338c384, received 800.098 ETH through several withdrawals, sold 799 ETH through CoW Swap for 1,947,391 USDC, and bridged that USDC to Base through Circle's CCTP. It passed a smaller share of MAMO, USDC, and gas ETH to the attacker account, 0x719eae70d4A83f35bF82A2740699F5db84BE919D, which carried out the rest of the exploit.

The attacker spent about $7.50 million buying roughly 94.3 million MAMO across dozens of trades on decentralized exchanges where liquidity was thin, and formally supplied 15,089,595 MAMO to Moonwell in exchange for mMAMO. At Moonwell's initial reference price of $0.010597, that supply was worth a modest $159,904.

The attacker sent 53,393,290 MAMO directly to the mMAMO contract in two transfers, 34,910,396.68 MAMO and 18,482,893.63 MAMO. Every mMAMO share now represented more MAMO than before, and the exchange rate jumped from about 0.020513 to 0.075460, roughly 3.68 times higher, without a single new share being issued.

Because the attacker already held about three-quarters of all outstanding mMAMO, it captured most of that inflation as paper collateral. It then pushed MAMO's price higher by buying into the same thin liquidity, driving the oracle's source feed from roughly $0.0106 up to a peak of $0.43127363, with Moonwell's own accepted price reaching $0.40248571 at its highest.

Multiplying an inflated mMAMO balance by an inflated exchange rate by an inflated price turned a real deposit worth a few hundred thousand dollars into a claim valued at roughly $22.3 million to $23.9 million, worth $11.1 million to $12 million of borrowing power at the market's 50% collateral factor.

The attacker drew on that borrowing power in 18 separate borrows across cbBTC, WETH, USDC, and wstETH, pulling out $11,028,762 of real assets in total before the price and exchange rate could move against it.

Liquidators moved in almost immediately, running 595 liquidation events and seizing nearly all of the attacker's mMAMO. But the borrowed assets and MAMO sale proceeds were already being converted and moved off Base by then.

Root Cause

This wasn't a broken oracle contract, or a bug in Moonwell's core lending code. The root failure is that Moonwell's supply cap only guarded the deposit path into mMAMO, so an attacker could send MAMO directly to the mMAMO contract and inflate every existing share's backing without minting a single new one or ever touching the cap meant to limit exactly that kind of exposure.

That inflated exchange rate turned into inflated collateral because the market priced positions using MAMO's own spot-derived oracle feed, which the same attacker could move by trading into MAMO's own thin liquidity. Combining an unguarded donation path with a manipulable price feed meant the attacker could set both halves of the collateral-value calculation, shares and price, in the same sequence of transactions.

Whether the supply cap's deposit-only scope was a deliberate design choice or an oversight in how MIP-B48 was implemented hasn't been publicly addressed.

How QuillAudits Infrastructure Review Could Have Prevented This

Cap the receipt token's backing, not just its mint path. Moonwell's 20 million MAMO supply cap only checked tokens flowing in through the deposit function. A cap enforced against the mMAMO contract's actual token balance, regardless of how tokens arrived, would have caught the direct transfer that inflated the exchange rate.

Don't let a single asset's own market set its own collateral price uncontested. MAMO's oracle tracked a feed sourced from the same thin on-chain liquidity the attacker was trading against. A review should flag any listed asset where the price source and the venue an attacker could realistically manipulate are the same market, and require a TWAP window, a liquidity floor, or a secondary feed before that asset can back real borrowing.

Treat a sudden receipt-token exchange-rate jump as an incident trigger, not a data point. The exchange rate moved 3.68 times in two transactions with no mint event attached. A monitor watching for exchange-rate deltas disconnected from mint or redeem activity would have flagged the inflation before the borrows against it went through.

Funds Flow After Attack

Attacker Swapped all the token to USDC and the used Circle CCTP bridge to turn USDC token on base and mint them on ethereum. $8.7M had been bridged using this.

Later Attacker converted these USDC tokens into DAI and trasfered them to another wallet 0xD71dD9B6e634412713c47fe7aE02c628e338C384 as of now funds are still siting in attacker wallet.

Post-Attack Mitigation

Moonwell has acknowledged the exploit and, as a precaution, reduced borrow caps for all Base Core Markets and supply caps for MAMO and WELL to 1 wei, while leaving caps for all other markets unchanged.

Moonwell shares a post-mortem covering the incident on its governance forum, and says it will keep posting updates as more information becomes available.

Relevant Addresses and Transactions

Attacker Wallets / EOAs

• Attacker account: 0x719eae70d4A83f35bF82A2740699F5db84BE919D
• Linked account: 0xd71dd9b6e634412713c47fe7ae02c628e338c384

Borrow Transactions

• Borrowed 0.50 cbBTC: 0x09687d741d92a2607a1d63014104bbad663347a79d7949d0f3073c84a395593e
• Borrowed 1.72 cbBTC: 0xb1fc41909fed850b8ba0f26223fa6fb57d1ae8b9079b9c1244bdd7c9291e4c53
• Borrowed 2.19 cbBTC: 0x9282f7ac2b98f4ac34ca64df6d5a69f10b64a954d1c876d2d4f7c2f9cb776e63
• Borrowed 0.96 cbBTC: 0xbf64f94b214243eda32a7504d03ccb477d4709803664c450fea5e7c6c544616d
• Borrowed 2.42 cbBTC: 0x739108389c545d1f31172dd6ccfdfeb967794d11935c14246935197119f2d341
• Borrowed 14.34 cbBTC: 0xafb6f0fa257b115a5c813bf787b4c1535e63888b1d0dbeb1f3788f557f51798f
• Borrowed 4.47 cbBTC: 0x9772ee564061c85a45320b87c33c170fac5069cdba0c0a8e45cf8be453a36314
• Borrowed 12.45 cbBTC: 0x6bac80e2797127c7c8de61fb7d8b86b2e8264be924c89bab2c72c0882883a495
• Borrowed 11.55 cbBTC: 0x7a75fe55c60339173a77e9326ff0d614e4258d3281db2bf57bc60216d3647323
• Borrowed 12.53 cbBTC: 0x6087b2d90a9782e312a7214713fe49e1087e01126868070c9caa3ec9a755f93f
• Borrowed 6.31 cbBTC: 0xb7891b3fd82f2b2334dee24a0a7b08294fee2349adcae26bc3751bf21266b08b
• Borrowed 1.92 cbBTC + 63.60 WETH: 0x921b138921b8e04eea1b5c104652ceefde644f631bcb9b7381a3e48e868c704e
• Borrowed 1.3M USDC: 0x8d3b9074eb4a7946eddf4e8bd0ffa3ae7fa1fdcf60cdd6b1c5a383946a21186b
• Borrowed 560 WETH: 0x7043f55bdcf70ea2980c8729299a022e842a9a6b8622e1c5a7ac527051800f02
• Borrowed 270K USDC: 0xe9eb6ba73ef9d5b3dcf6f813a5cce672725b46a650c56449b6ea494fd7c171b5
• Borrowed 368 wstETH: 0x2d1c356e8e77f9b5df9589381a1ff6f63153148710a113ccd8da1174870b23d7
• Borrowed 990K USDC, final borrow: 0xee2b75648c288e0e57678a177d54aec2e8ecb8920842c72e8784186c18c88b18

Bridge Transactions

• 0x9b362a0a28723ba6c3f891329ea1df9785ad156b1fb9b5b317ea623c9150f86e
• 0x0bcf401c128cd8d99d067213a65c1f0dcbe720c928cd85fa904cfcbcaad19ca4

Conclusion

A cap built to limit how much MAMO could be minted into collateral didn't cover MAMO sent straight to the contract, and the same attacker who inflated the exchange rate that way also had the liquidity to move the price backing it. Both halves of a collateral calculation, shares and price, sat within reach of the same wallet. A cap that only watches one door isn't a cap, it's a suggestion for the door the attacker didn't use.