Pump the Price, Take $8.7M: Breaking Down the Moonwell AttackOn August 27, $8.7M in assets was drained from Moonwell. The key to the attack wasn’t a bug in the code. It was the price of the collateral.
The attacker pushed up the price of the illiquid MAMO token through a series of large buys, deposited it into Moonwell at an inflated valuation, and borrowed liquid assets against it.
The attack started six days before the funds movedBitOK analysts reconstructed the preparation behind the attack. A linked address received 800 ETH from Tornado Cash, moved part of the funds across Ethereum, Cronos, and Arbitrum, and then prepared the capital for the attack on Base.
On Base, funds and MAMO were sent to a separate address. Then the attack unfolded:
➤ large buys pushed up the price of MAMO;
➤ at least 35.5M MAMO was deposited into Moonwell as collateral;
➤ against the inflated collateral, the attacker borrowed 71.36 cbBTC, 2.56M USDC, 560 WETH, and 368 wstETH.
From Moonwell back to Ethereum: where did the $8.7M end up?After the withdrawal, the assets were converted to USDC and moved from Base to Ethereum via Circle CCTP. There, 8.728M USDC was swapped for DAI and sent back to the address where the attack preparation had started.
After all the swaps and cross-chain transfers, the funds returned to the original address as $8.7M in DAI.
At the time of our analysis, the funds were still sitting in that wallet with no confirmed onward movement.
Funds can change chains, assets, and wallets, but their history remains part of the risk picture. Check addresses and transaction history before you transact with BitOK Bot.Website | Telegram | BitOK bot
