EIR
Educatio · Iustitia · Recuperatio
COMMUNITY-BASED, NOT-FOR-PROFIT
$1 000 000 USD
OCTOBER 2025
GLOBAL
MOONWELL
DESCRIPTION OF EVENTS
Moonwell is a decentralized lending and borrowing platform that allows users to put their digital assets to work without the hassle of monthly payments or additional fees. It offers flexible lending and borrowing options, where users can pay back on their own schedule. Moonwell prioritizes security and user confidence, with all its smart contracts undergoing thorough audits from trusted security partners like Halborn, Certora, and Code4rena, which also runs a bug bounty program with rewards up to $250,000 for discovering vulnerabilities.
The platform supports 60 markets across four blockchain networks, allowing users to lend and borrow a variety of digital assets, from cryptocurrencies like Ethereum and Bitcoin to stablecoins such as USDC and DAI. Moonwell provides competitive annual percentage yields (APY) on supplied assets and offers borrowing opportunities with different tokens, making it a versatile option for users looking to leverage their holdings. The platform is also governed by the community, with decisions made through distributed governance, enabling Moonwell to adapt and upgrade its features based on user input.
Moonwell also introduces the Moonwell Card, further enhancing user engagement with digital assets. The platform encourages participation in its community governance model and invites users to get involved through various communication channels like Discord and Telegram. By making lending and borrowing accessible, secure, and community-driven, Moonwell aims to empower individuals in managing their digital assets more effectively and capitalize on the potential of compound interest.
"Oracle feeds priced AERO, VIRTUAL, and MORPHO on Base lower compared to DEX pool prices. An attacker flash loaned USDC/cbBTC, borrowed underpriced assets from Moonwell at 85-88% LTV, sold them on a DEX for more than the value of their flash loan, repaid the flash loan, and profited from the difference. The user repeated this process multiple times, increasing the amount supplied and borrowed in their Moonwell position, withdrawing collateral whenever possible due to its value increasing or debt values decreasing. This allowed the attacker to extract value in two ways: profiting from the price difference during the flash loan arbitrage and withdrawing collateral that had been "spawned in" through these flashloans."
Losses were estimated by SlowMist at $1,000,000 USD.
CertiKAlert - "We have detected multiple exploit transactions on @MoonwellDeFi lending contract. The exploiter was able to repeatedly borrow over 20 wstETH with only ~0.02 wrstETH flashloaned and deposited due to the faulty oracle that returns wrst price of ~5.8M$ and profited 295 ETH (~$1M)." - Twitter/X (Nov 18)
[Anthias Labs] Report on the Events of October 10th, 2025 - Discussion - Moonwell Governance Forum (Sep 28)
Moonwell Oracle Exploit Timeline (Nov 18)
Moonwell DeFi Twitter/X Account (Sep 28)
Moonwell DeFi Homepage (Sep 28)
