Principal account: 0x719e...919D
Linked operational account: 0xD71d...C384
Evidence cutoff: Base block 50,524,962, 27 August 2026 at 14:01:11 UTC; supplementary verification through 28 August 2026
Summary
On 27 August 2026, an actor exploited Moonwell’s MAMO market on Base by combining collateral-accounting inflation with manipulation of MAMO’s oracle price. The operation was seeded with approximately 799 ETH, which a linked funding wallet converted into 1,947,391 USDC and bridged to Base. Although the wallets ultimately used approximately $7.50 million of gross purchasing volume to acquire MAMO, much of that amount consisted of borrowed assets recycled during the operation. The clearest measure of externally supplied principal is therefore the initial $1.947 million USDC.
The exploit combined three mechanisms:
- The principal account accumulated MAMO and formally supplied 15,089,595 MAMO to Moonwell, receiving mMAMO receipt tokens.
- It transferred another 53,393,290 MAMO directly into the mMAMO contract without minting new mMAMO. These transfers increased the MAMO backing each existing mMAMO share, raising the exchange rate by approximately 3.68 times without consuming the market’s mint-path supply cap.
- The linked accounts purchased approximately 94.31 million MAMO through decentralized exchanges while liquidity was thin. During this sequence, the MAMO/USD source feed rose from approximately $0.010597 to $0.43127363.
The protocol valued the position approximately as:
mMAMO shares × mMAMO exchange rate × MAMO oracle price
Valuing the full 15,089,595 MAMO formally supplied at the initial reference price of $0.010597 produces a baseline value of approximately $159,904.44.
The direct MAMO transfers subsequently increased the underlying represented by the principal account’s mMAMO to approximately 55.51 million MAMO. Because the account controlled roughly three quarters of the outstanding mMAMO, it captured most of the exchange-rate increase as additional collateral value.
At the peak source-feed price of $0.43127363, the enlarged claim was worth approximately $23.94 million, representing approximately $11.97 million of nominal borrowing capacity at the market’s 50% collateral factor. Moonwell’s highest archived accepted price was lower, at $0.40248571. At that price, the enlarged claim was worth approximately $22.34 million, corresponding to approximately $11.17 million of borrowing capacity.
The principal account completed 18 borrows across cbBTC, WETH, USDC, and wstETH. Gross principal advanced was $11,028,762, valued using Moonwell’s oracle at each borrow block. The actor converted the borrowed assets and MAMO sale proceeds through several liquidity venues, then burned 8,729,454 USDC on Base through Wormhole’s CCTPv2-with-Executor helper over Circle CCTP V2. Ethereum received 8,728,319 USDC, which was converted through Velora into the same amount of canonical DAI and transferred to the linked operational account.
Liquidation began 32 seconds after the final successful borrow. We confirmed 595 liquidation events across 594 transactions. Liquidators repaid part of the debt and seized nearly all of the principal account’s minted mMAMO. At the later evidence cutoff, approximately $9.131 million of borrower obligations remained on Moonwell’s oracle basis. This is our best estimate of residual debt and potential bad debt.
In summary:
- $1.947 million is the clearest measure of initial stablecoin capital deployed.
- Approximately $7.50 million is gross MAMO purchasing volume, including recycled borrowed assets.
- $11.03 million is the total value borrowed from Moonwell, not subtracting any liquidations or debt repayments.
- $8.729 million is the gross USDC burned on Base through CCTP.
- $8.728 million is the USDC received on Ethereum and subsequently converted to DAI.
- $6.785 million is the traced stablecoin balance increase above the initial USDC, before gas, or remaining assets. It is a gain estimate.
- Approximately $9.1 million is the remaining borrower debt or shortfall at current oracle prices.
Linked funding account
│
├── USDC, MAMO and gas ───────────────┐
│ ▼
│ Principal account
│ │
│ buys MAMO and mints mMAMO
│ │
│ sends 53.39M MAMO directly to mMAMO
│ │
│ mMAMO exchange rate increases
│ │
│ MAMO/USD feed and accepted price increase
│ │
│ collateral value and borrow power increase
│ │
│ cbBTC / WETH / USDC / wstETH borrowed
│ │
│ assets converted and consolidated
│ │
└──────── receives 8.728M DAI ◄── CCTP to Ethereum
Market background
MIP-B48 listed MAMO on 15 October 2025 with:
| Parameter | Listing value |
|---|---|
| Collateral factor | 50% |
| Supply cap | 20,000,000 MAMO |
| Borrow cap | 3,000,000 MAMO |
| Reserve factor | 30% |
Funding and operational linkage
The linked account received 800.098ETH from Tornado Cash:
| Date | Receipt |
|---|---|
| 21 August | 0.09793270584795 ETH |
| 21 August | 100 ETH |
| 23 August | Seven withdrawals of 100 ETH |
| Total | 800.09793270584795 ETH |
An initial 99 ETH was routed through Stargate/LayerZero to Cronos. 15 WETH was later routed from Cronos to Base, delivering 14.990999 ETH. Most of the 99 ETH returned to Ethereum through Stargate and Across paths using Ethereum, Arbitrum, and Base. The observed return receipts total 98.92 ETH.
The linked account later sold 99 ETH and 700 ETH through CoW Swap:
| ETH sold | USDC received | Settlement |
|---|---|---|
| 99 ETH | 232,296.039013 | Ethereum transaction |
| 700 ETH | 1,715,095.287786 | Ethereum transaction |
| 799 ETH | 1,947,391.326799 |
The full USDC amount was burned through Circle CCTP on Ethereum and minted on
Base: Ethereum burn and Base mint.
On Base, the linked account supplied 10,000 USDC to Moonwell, purchased 7,407,608 MAMO for 75,000 USDC, and borrowed 582,000 MAMO. It ultimately transferred the following to the principal:
| Asset | Amount transferred |
|---|---|
| MAMO | 7,989,608.308454131564260237 |
| USDC | 1,862,391.328149 |
| ETH for gas | 0.0003 |
Incident timeline
All times are UTC on 27 August 2026 unless stated otherwise.
| Time | Event |
|---|---|
| 06:09:45 | Linked account sends 0.0003 ETH to the principal account. |
| 06:18:09 | First observed principal-account transaction deploys an unverified helper contract. |
| 06:20:17 | First confirmed principal-account MAMO/USDC pool swap. |
| 07:04:11 | First confirmed mMAMO mint by the principal account. |
| 08:18:53 | Principal enters mMAMO as a collateral market. |
| 08:43:13 | First confirmed principal borrow: 0.50071233 cbBTC. |
| 09:19:59 | Principal transfers 34,910,3971 MAMO directly to mMAMO without minting. |
| 09:21:09 | Principal transfers another 18,482,8941 MAMO directly to mMAMO without minting. |
| 09:28:49 | MAMO source feed reaches $0.43127363. |
| 09:29:31 | Moonwell-accepted MAMO price reaches $0.40248571; 368 wstETH is borrowed in the same block. |
| 09:30:13 | Final successful principal borrow: 990,000 USDC. |
| 09:30:45 | First confirmed liquidation against the principal. |
| 09:41:43 | First 4,364,726.91 USDC CCTP burn. |
| 09:42:43 | Second 4,364,726.91 USDC CCTP burn. |
| 09:46:25 | Last confirmed mMAMO liquidation. |
| 10:53:43 | Emergency transaction reduces borrow caps to 1 wei. |
| 11:09:43 | MAMO supply cap is reduced to 1 wei. |
1. MAMO accumulation
The principal account executed 47 MAMO purchases and acquired 86,898,255 MAMO. Including the linked account’s purchase, the two accounts bought 94,305,863 MAMO via DEXs. Including the linked account’s 582,000 MAMO borrow, total MAMO sourced was 94,887,863 MAMO.
Exact MAMO purchase inputs were 1,993,720.96 USDC and 68.784 cbBTC. This is approximately $7.50 million of gross MAMO purchase volume.
2. Formal collateral supply
Three confirmed mMAMO Mint events formally supplied: 15,089,595 MAMO
3. Direct transfers increased the exchange rate
The principal then transferred MAMO directly to the mMAMO contract:
| Time | Direct MAMO transfer | Evidence |
|---|---|---|
| 09:19:59 | 34,910,396.684792643774173421 | Transaction |
| 09:21:09 | 18,482,893.625840745520359231 | Transaction |
| Total | 53,393,290.310633389294532652 |
Neither transaction emitted an mMAMO Mint event. mMAMO total supply stayed unchanged at those transfer blocks, while market cash and the stored exchange rate increased. The exchange rate rose from approximately 0.020513 to 0.075460 MAMO per mMAMO share, approximately 3.6788 times.
The 20 million MAMO supply cap checked formal mint inputs. It did not prevent an unsolicited underlying transfer from increasing the MAMO represented by existing mMAMO shares. Because the principal owned roughly three quarters of the mMAMO supply, it captured roughly the same share of the exchange-rate increase as additional collateral value.
4. Oracle price amplified the enlarged claim
The MAMO/USD source feed increased from about $0.0106 before the main sequence to
$0.43127363. Moonwell’s highest archived accepted value was $0.40248571. The MAMO/USDC pool on Aerodrome repeatedly used by the principal recorded a maximum principal-transaction VWAP of $0.458621073364.
4.1 Oracle sequence
| Time | MAMO Price |
|---|---|
| 09:06:11 | $0.01059700 |
| 09:11:41 | $0.01373100 |
| 09:15:13 | $0.02327238 |
| 09:16:11 | $0.03230471 |
| 09:19:11 | $0.08386082 |
| 09:21:13 | $0.11452183 |
| 09:24:43 | $0.23347900 |
| 09:25:13 | $0.26172980 |
| 09:28:43 | $0.43127363 |
| 09:31:43 | $0.35790055 |
| 09:32:13 | $0.23114443 |
| 09:32:43 | $0.09730403 |
| 09:33:13 | $0.04851815 |
| 09:39:43 | $0.02456400 |
| 09:45:13 | $0.01421659 |
5. Borrowing against the inflated collateral
The principal completed 18 borrows across 17 transactions:
| Asset | Gross borrowed | Repaid in liquidations | Residual Debt |
|---|---|---|---|
| cbBTC | 71.35549505 | 17.76122375 | 53.59557362 |
| WETH | 623.600287604679454542 | 38.573335900949439222 | 585.172598832234454703 |
| USDC | 2,560,000 | 215,841.545449 | 2,345,280.551834 |
| wstETH | 368 | 25.307914898863610231 | 342.747232268469364791 |
5.1 Borrowing sequence
| Time (UTC) | Asset | Amount | Transaction |
|---|---|---|---|
| 08:43:13 | cbBTC | 0.50071233 | Transaction |
| 09:16:19 | cbBTC | 1.72279600 | Transaction |
| 09:17:37 | cbBTC | 2.18725820 | Transaction |
| 09:18:41 | cbBTC | 0.96129886 | Transaction |
| 09:19:31 | cbBTC | 2.42063849 | Transaction |
| 09:20:11 | cbBTC | 14.33812576 | Transaction |
| 09:20:35 | cbBTC | 4.46614122 | Transaction |
| 09:21:27 | cbBTC | 12.44801555 | Transaction |
| 09:23:09 | cbBTC | 11.55282068 | Transaction |
| 09:23:41 | cbBTC | 12.52661663 | Transaction |
| 09:24:03 | cbBTC | 6.31084084 | Transaction |
| 09:24:51 | cbBTC | 1.92023049 | Transaction |
| 09:24:51 | WETH | 63.600287604679454542 | Transaction |
| 09:25:59 | USDC | 1,300,000 | Transaction |
| 09:28:29 | WETH | 560 | Transaction |
| 09:28:49 | USDC | 270,000 | Transaction |
| 09:29:31 | wstETH | 368 | Transaction |
| 09:30:13 | USDC | 990,000 | Transaction |
An attempted 2 million AERO borrow at 09:29:53 produced no AERO transfer and is excluded.
6. Conversion and cross-chain proceeds
The principal sold 26,404,977 MAMO, receiving 3,345,134.62 USDC while consuming a net 1.08842844 cbBTC in those routes. Together with the 68,482,886 MAMO supplied or transferred to mMAMO, this reconciles the full 94,887,863MAMO inventory.
The principal completed two equal Base burns through Wormhole’s CCTPv2WithExecutor helper, which called Circle TokenMessenger V2:
| Time | Base USDC burned | Ethereum USDC received | Evidence |
|---|---|---|---|
| 09:41:43 | 4,364,726.913196 | 4,364,159.498698 | Base burn / Ethereum mint |
| 09:42:43 | 4,364,726.913196 | 4,364,159.498698 | Base burn / Ethereum mint |
| Total | 8,729,453.826392 | 8,728,318.997396 |
The 1,134.83 USDC difference is the cross-chain execution amount. At 09:44:47, the principal converted all Ethereum USDC to exactly 8,728,318.99 canonical DAI through Velora (transaction). One minute later, it transferred all DAI to the linked operational account
(transaction). That account held the exact canonical DAI amount when checked on 28 August 2026.
Liquidation and financial impact
Liquidation began at 09:30:45, 32 seconds after the final successful borrow, and continued through 09:46:25.
- 595 liquidation events across 594 transactions;
- 17.761 cbBTC, 38.573 WETH, 215,841 USDC, and 25.308 wstETH repaid by liquidators; and
- 735,602,421 mMAMO seized, ~100% of the principal’s minted mMAMO.
Reconciled financial measures
| Measure | Bounded value | What it means |
|---|---|---|
| ETH received from Tornado Cash | 800 ETH | Where that ETH came from before Tornado Cash cannot be seen |
| ETH sold to raise starting funds | 799 ETH | Sold for 1,947,391 USDC |
| Total MAMO bought | about $7.50 million | Includes MAMO bought with borrowed cbBTC. |
| Total amount borrowed from Moonwell | $11,028,761.70 | Value of the loans using oracle prices at each borrow. |
| USDC sent off Base through CCTP | 8,729,453 USDC | Total proceeds sent from Base |
| USDC received on Ethereum / final DAI | 8,728,318 USDC / DAI | Amount received on Ethereum before Ethereum gas, later held as DAI |
| USDC left on Base in the main account | 3,727 USDC | Wallet USDC balance |
| Traced rise in stablecoins | $6,784,655 | Final DAI plus leftover Base USDC, minus the starting USDC. |
| Remaining loan balance | $9,131,342 | Debt still showing on Moonwell, at current prices |
Anthias will preserve the underlying evidence so that later updates to recoveries, supplier exposure, or remediation status can be added without changing the confirmed on-chain record.