# wrsETH Oracle Malfunction 11/4/25 **URL:** \ **Category:** Updates\ **Tags:** base\ **Created:** [November 4, 2025, 5:08pm UTC](https://forum.moonwell.fi/t/wrseth-oracle-malfunction-11-4-25/2017 "2025-11-04T17:08:15Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![AnthiasLabs](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.moonwell.fi/anthiaslabs/32/3489_2.png) [@AnthiasLabs](https://forum.moonwell.fi/u/AnthiasLabs)\ **Post date:** [November 4, 2025, 5:08pm UTC](https://forum.moonwell.fi/t/wrseth-oracle-malfunction-11-4-25/2017/1 "2025-11-04T17:08:15Z")
## What Happened At approximately 5:44 AM UTC on November 4th, an incident occurred involving the wrsETH market on Base. Due to an oracle malfunction, wrsETH collateral was drastically overvalued enabling an attacker to borrow millions in various assets using minimal wrsETH collateral. The protocol prices wrsETH using two Chainlink oracles: an ETH/USD oracle and a wrsETH/ETH oracle. To derive the USD price of wrsETH, the protocol multiplies these two feeds together. The issue originated from the wrsETH/ETH oracle, which erroneously reported that 1 wrsETH equals 1,649,934.60732 ETH—valuing a single wrsETH token at approximately $5.8 billion. Notably, this was the same user responsible for the 10/10/25 exploit. Attacker (contract): [0x42ecd332d47c91cbc83b39bd7f53cebe5e9734bb](https://basescan.org/address/0x42ecd332d47c91cbc83b39bd7f53cebe5e9734bb) Attacker (EOA): [0x6997a8c804642ae2de16d7b8ff09565a5d5658ff](https://basescan.org/address/0x6997a8c804642ae2de16d7b8ff09565a5d5658ff) ETH/USD oracle: [0x71041dddad3595F9CEd3DcCFBe3D1F4b0a16Bb70](https://basescan.org/address/0x71041dddad3595F9CEd3DcCFBe3D1F4b0a16Bb70) wrsETH/ETH oracle: [0xd7221b10FBBC1e1ba95Fd0B4D031C15f7F365296](https://www.notion.so/moonwell-exploit-11-4-2a17b406e41680608ea1d9e0360f139b?pvs=21) The first massive faulty reading from the wrsETH/ETH oracle occurred at precisely 5:44:55 UTC, and the attack was executed within 30 seconds of this malfunction. ![oracle_components_all-1](https://europe1.discourse-cdn.com/flex017/uploads/moonwell/original/2X/f/f812c000b97492e342ed1202a1e531773c9da517.png) ### Transaction Details The attack started on block 37722875 with the first transaction (hash: [0x229caeb87e0b6c31afad950150d2ba05a8d7fe823c9e5c05af63b4150b8f6cc6](https://basescan.org/tx/0x229caeb87e0b6c31afad950150d2ba05a8d7fe823c9e5c05af63b4150b8f6cc6)) flash loaning 0.00065 wrsETH to withdraw 1.206M cbXRP. This was followed by a set of 11 transactions:: | Timestamp | Transaction Hash | Borrowed Token | Token Amount | | --- | --- | --- | --- | | Nov-04-2025 05:44:57 AM +UTC | [Base Transaction Hash: 0x229caeb87e... | BaseScan](https://basescan.org/tx/0x229caeb87e0b6c31afad950150d2ba05a8d7fe823c9e5c05af63b4150b8f6cc6) | cbXRP | 1.206M | | Nov-04-2025 05:44:59 AM +UTC | [Base Transaction Hash: 0xecb1c96e15... | BaseScan](https://basescan.org/tx/0xecb1c96e15889dc11d2928f6e63e34abcb8b1114bd69f15a794fa4df07f647aa) | EURC | 80k | | Nov-04-2025 05:45:01 AM +UTC | [Base Transaction Hash: 0x7855a861bb... | BaseScan](https://basescan.org/tx/0x7855a861bb27ba93aac37ec60e2de3381c46f82070dc4d300aca70ee05cc69ec) | EURC | 73.3k | | Nov-04-2025 05:45:03 AM +UTC | [Base Transaction Hash: 0xc5daf8bfea... | BaseScan](https://basescan.org/tx/0xc5daf8bfea0b7f6c5da8e4b08e19df2be58094a366aa2387e9b9443fb0e0c0d4) | USDC | 80k | | Nov-04-2025 05:45:05 AM +UTC | [Base Transaction Hash: 0xa5f60967fc... | BaseScan](https://basescan.org/tx/0xa5f60967fc6ad8c0f5b82f1a12970371333c16d8dddee5cd3a4f8a95561769fd) | AERO | 101k | | Nov-04-2025 05:45:23 AM +UTC | [Base Transaction Hash: 0x815715adbf... | BaseScan](https://basescan.org/tx/0x815715adbf5032d1b968d5fda6c3589d2f4d3ab0b7a12c42f7f6a3cddbf99ff9) | AERO | 101k | | Nov-04-2025 05:45:11 AM +UTC | [Base Transaction Hash: 0x190a491c0e... | BaseScan](https://basescan.org/tx/0x190a491c0ef095d5447d6d813dc8e2ec11a5710e189771c24527393a2beb05ac) | wstETH | 21 | | Nov-04-2025 05:45:13 AM +UTC | [Base Transaction Hash: 0xff3075de35... | BaseScan](https://basescan.org/tx/0xff3075de35647efed753a918d20a92d9113e14a86a6dc98064b94249d14a54c1) | wstETH | 20.5 | | Nov-04-2025 05:45:15 AM +UTC | [Base Transaction Hash: 0x76911abc58... | BaseScan](https://basescan.org/tx/0x76911abc581204db6063763b024de0bf7bb1bbb62f61dc81be3bac4bc9e474b2) | wstETH | 20.5 | | Nov-04-2025 05:45:21 AM +UTC | [Base Transaction Hash: 0x5cd5b182e8... | BaseScan](https://basescan.org/tx/0x5cd5b182e8be9e13360970d851f2479376f9de30f9f07dda617e6deba5e72ca4) | wstETH | 20 | | Nov-04-2025 05:45:17 AM +UTC | [Base Transaction Hash: 0xd74224baa3... | BaseScan](https://basescan.org/tx/0xd74224baa38bb6872769d43469aea69f45683281ca475c658338f2c08e5f412d) | cbETH | 24 | | Nov-04-2025 05:45:19 AM +UTC | [Base Transaction Hash: 0x26abab9dd1... | BaseScan](https://basescan.org/tx/0x26abab9dd1119f13ba4899cea1d5875e3c5286427732a4eb7143aa44485cf6e0) | cbETH | 24 | The borrowed tokens were atomically swapped to WETH in the same transaction and sent to the attacker’s original address ([0x6997a8c804642ae2de16d7b8ff09565a5d5658ff](https://basescan.org/address/0x6997a8c804642ae2de16d7b8ff09565a5d5658ff)). All of these transactions combined led to a total bad debt of $3.7M on Moonwell. The address can be viewed on Debank here: [0x42ecd332d47c91cbc83b39bd7f53cebe5e9734bb](https://debank.com/profile/0x42ecd332d47c91cbc83b39bd7f53cebe5e9734bb) ![Screenshot 2025-11-04 at 8.24.09 PM](https://europe1.discourse-cdn.com/flex017/uploads/moonwell/original/2X/7/769962c672092f6d71dfdd84f5aaff78b4094094.png) ## What We Did Immediately following the exploit we zeroed out supply and borrow caps for wrsETH, effectively pausing activity in the wrsETH markets on both Base and Optimism. This ensures wrsETH can no longer be supplied or borrowed by any new users. We also reduced borrow caps in all markets on base and optimism (reducing them all to 0.1), temporarily pausing additional borrows across all markets. This is done to mitigate the risk of any previous wrsETH suppliers over-borrowing if the oracle continues to give incorrect prices. This restriction will be lifted once a fix to this oracle is in place. ---
**Author:** ![surfingdegen](https://avatars.discourse-cdn.com/v4/letter/s/85f322/32.png) [@surfingdegen](https://forum.moonwell.fi/u/surfingdegen)\ **Post date:** [November 4, 2025, 11:51pm UTC](https://forum.moonwell.fi/t/wrseth-oracle-malfunction-11-4-25/2017/2 "2025-11-04T23:51:45Z")
Thanks for producing this in a timely manner. While the bad debt is a concern, I’m more focused on today’s outflows. Will there be a report detailing the outflows and effects on TVL? Thx… just calculated a rough estimate of -$284Million outflows yesterday… ![Screenshot 2025-11-05 8.35.48 AM](https://europe1.discourse-cdn.com/flex017/uploads/moonwell/original/2X/5/50659c59564a7ab521f94865655f1dc410c93be0.png) ---
**Author:** ![djangobits](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.moonwell.fi/djangobits/32/3082_2.png) [@djangobits](https://forum.moonwell.fi/u/djangobits)\ **Post date:** [November 5, 2025, 5:11am UTC](https://forum.moonwell.fi/t/wrseth-oracle-malfunction-11-4-25/2017/3 "2025-11-05T05:11:56Z")
What exactly was the “oracle malfunction”?. Why did it return the price it returned? ---
**Author:** ![WellMaxi](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.moonwell.fi/wellmaxi/32/3803_2.png) [@WellMaxi](https://forum.moonwell.fi/u/WellMaxi)\ **Post date:** [November 6, 2025, 3:52am UTC](https://forum.moonwell.fi/t/wrseth-oracle-malfunction-11-4-25/2017/4 "2025-11-06T03:52:15Z")
How did the exploit happen suspiciously seconds after the “oracle price malfunction” How did this attacker know the vulnerability of moonwell using a discontinued price feed and be able to execute 11 transactions within seconds. something smells fishy! ---
**Author:** ![WellMaxi](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.moonwell.fi/wellmaxi/32/3803_2.png) [@WellMaxi](https://forum.moonwell.fi/u/WellMaxi)\ **Post date:** [November 6, 2025, 4:00am UTC](https://forum.moonwell.fi/t/wrseth-oracle-malfunction-11-4-25/2017/5 "2025-11-06T04:00:12Z")
that’s nuts! GOOD-BYE TVL Tha’s what a run-on-the-bank from complete loss of trust looks like. Especially knowing that the exploit happened by the same attacker from 10/10… on the same issue. (Oracle price feeds) IF the attacker had used a little bit more than 0.0₅8783 wstETH as collateral, they would have taken out all liquidity from from the core markets. WOW. ---
**Author:** ![AnthiasLabs](https://dub1.discourse-cdn.com/flex017/user_avatar/forum.moonwell.fi/anthiaslabs/32/3489_2.png) [@AnthiasLabs](https://forum.moonwell.fi/u/AnthiasLabs)\ **Post date:** [November 12, 2025, 9:27am UTC](https://forum.moonwell.fi/t/wrseth-oracle-malfunction-11-4-25/2017/6 "2025-11-12T09:27:44Z")
As of November 12, 2025, borrow caps have been fully restored on both Base and OP Mainnet. This restoration follows the quarantine of the wrsETH markets on Base and OP Mainnet, along with the upgrade of their oracles to exchange-rate oracles. The governance proposal to implement this oracle switch was recently executed ([link](https://moonwell.fi/governance/proposal/moonbeam?id=208)).