Project
Moonwell is a decentralized lending and borrowing protocol on Base and other EVM-compatible blockchains for supplying and borrowing crypto assets.
A 20-minute push on TONIC's price bought the attacker $74 million in borrows against it, but only about $6 million reached Ethereum before Cronos stopped producing blocks and rewound its own state.
Perspective Coverage
3 publishersReality
Four security firms classified the $3.5 million Nostra Finance loss as oracle price manipulation. The remedies the write-up lists are listing-policy parameters: a borrow cap below free float, an isolation flag, a deviation bound.
Reality
Moonwell's lending markets kept running while the Visa card sitting on top of them ended with Cypher's sale to Nium, and any balance still loaded on those cards has until September 6 to move back to a wallet.
Reality
The Moonwell post-mortem puts externally supplied capital at $1.95m. Recycled through repeated borrowing, that money moved $7.5m of MAMO buying. That ratio, rather than the loss total, sets an attacker's entry price.
Reality
Removing the price feed moved the number an attacker had to distort rather than deleting it. The $775,000 taken came to 3.8 times the TVL DefiLlama recorded for Ajna V2, and the loan book has since fallen 92.8%.
Reality
Estimates of the loss run from $4M to $9M against the $72.77M locked in Moonwell, and the remedy was a borrow cap set to 1 wei, which is the tell that this was an underwriting choice rather than a bug.
Reality