MOONWELL

DESCRIPTION OF EVENTS

Moonwell is a decentralized lending and borrowing platform that allows users to put their digital assets to work without the hassle of monthly payments or additional fees. It offers flexible lending and borrowing options, where users can pay back on their own schedule. Moonwell prioritizes security and user confidence, with all its smart contracts undergoing thorough audits from trusted security partners like Halborn, Certora, and Code4rena, which also runs a bug bounty program with rewards up to $250,000 for discovering vulnerabilities.

The platform supports 60 markets across four blockchain networks, allowing users to lend and borrow a variety of digital assets, from cryptocurrencies like Ethereum and Bitcoin to stablecoins such as USDC and DAI. Moonwell provides competitive annual percentage yields (APY) on supplied assets and offers borrowing opportunities with different tokens, making it a versatile option for users looking to leverage their holdings. The platform is also governed by the community, with decisions made through distributed governance, enabling Moonwell to adapt and upgrade its features based on user input.

Moonwell also introduces the Moonwell Card, further enhancing user engagement with digital assets. The platform encourages participation in its community governance model and invites users to get involved through various communication channels like Discord and Telegram. By making lending and borrowing accessible, secure, and community-driven, Moonwell aims to empower individuals in managing their digital assets more effectively and capitalize on the potential of compound interest.

"The exploiter was able to repeatedly borrow over 20 wstETH with only ~0.02 wrstETH flashloaned and deposited due to the faulty oracle that returns wrst price of ~5.8M$ and profited 295 ETH (~$1M)."

"The faulty price of $5.8B (correction) trace to abnormal wrsETH/ETH exchange rate reading of 1649934607316470707093500, transmitted to the off-chain aggregator at block 37722874 right before the exploit txn."

Losses were estimated by SlowMist at $1,000,000 USD.

CertiK and Moonwell DeFi both posted information about the exploit.

CertiKAlert - "We have detected multiple exploit transactions on @MoonwellDeFi lending contract. The exploiter was able to repeatedly borrow over 20 wstETH with only ~0.02 wrstETH flashloaned and deposited due to the faulty oracle that returns wrst price of ~5.8M$ and profited 295 ETH (~$1M)." - Twitter/X (Nov 18)
[Anthias Labs] Report on the Events of October 10th, 2025 - Discussion - Moonwell Governance Forum (Sep 28)
Moonwell DeFi Twitter/X Account (Sep 28)
Moonwell DeFi Homepage (Sep 28)

More case studies

Balancer V2 Composable Stable
Pool Invariant Manipulation

None