Another DeFi protocol hacked? Lending protocol Moonwell suspected of being attacked by hackers, with losses exceeding $1 million

DeFi Lending Protocol Moonwell Reportedly Under Hacker Attack Today (4th Afternoon)

Security agencies BlockSec and CertiK issued alerts simultaneously, indicating that the protocol was targeted by a flash loan attack due to abnormal oracle prices, resulting in a loss of over $1 million.

(Background: Cross-chain bridge Garden Finance was hacked, losing approximately $5.5 million, with an official offering a 10% bounty for hackers to return the funds.) (Additional context: The veteran DeFi protocol Balancer has experienced six security incidents over five years, with total losses exceeding hundreds of millions of dollars.)

The decentralized lending protocol Moonwell, built on the Base and Optimism chains, was reportedly attacked this afternoon (4th). Security monitoring agencies BlockSec Phalcon and CertiK issued alerts earlier today, pointing out that the protocol’s smart contracts were subjected to a series of suspicious transactions. Current estimates indicate losses exceeding $1 million.

BlockSec Phalcon First Alerts: MEV Bots Suspected of Automated Attack

BlockSec Phalcon posted on X today:
Alert! Our system detected a series of suspicious transactions targeting @MoonwellDeFi’s smart contracts on #Base and #Optimism.
Analysis shows an issue with the off-chain oracle’s token price feed (rsETH / ETH), which was exploited—possibly by a MEV bot—leading to losses over $1 million. The prices used by the protocol appear to have been incorrectly updated.

BlockSec Phalcon emphasized that they are currently unable to contact the Moonwell team directly and urged users to stay vigilant.

ALERT! Our system detected a series of suspicious transactions targeting @MoonwellDeFi’s smart contracts on (Optimism. Our analysis indicates an issue with the token price )rsETH / ETH( feed from the off-chain oracle, which was exploited — possibly by a MEV bot —… pic.twitter.com/cNJFHI3xn3
— BlockSec Phalcon )@Phalcon_xyz( November 4, 2025

CertiK Reveals Attack Details: Borrowed 0.02 with 20x Leverage

Following this, the well-known blockchain security firm CertiK also issued a detailed alert:

We detected multiple exploit transactions on @MoonwellDeFi’s lending contracts. The attacker was able to repeatedly borrow over 20 wstETH with only about 0.02 wrstETH borrowed via flashloan and deposited, due to a faulty oracle reporting wrstETH prices as high as approximately $5.8 million, ultimately earning 295 ETH (about $1 million).

#CertiKInsight
We have detected multiple exploit transactions on @MoonwellDeFi lending contract. The exploiter was able to repeatedly borrow over 20 wstETH with only ~0.02 wrstETH flashloaned and deposited due to the faulty oracle that returns wrstETH price of ~5.8 million dollars, and… pic.twitter.com/130RHsUe4J — CertiK Alert )@CertiKAlert November 4, 2025

Not the First Crisis: Moonwell’s Security Record Adds Another Incident

In fact, Moonwell has faced multiple security challenges in the past, but this incident is the most severe recently. Specifically, in December 2024, Moonwell was targeted by a flash loan attack resulting in approximately $320,000 USDC in losses; in January 2024, following the Nomad bridge hack, the protocol faced a $2.3 million US dollar bad debt issue in the FRAX pool.

At the time of writing, Moonwell’s official response has not yet been released. The community is calling on the team to suspend related lending pools immediately and initiate an investigation. Participants in DeFi are advised to review their wallet activity to prevent further losses.

Related Reports:

• “Three times in two years! Lending protocol Abracadabra Money was hacked again, losing $1.8 million, with total losses reaching $21 million”
• “Web3 incubator Seedify’s cross-chain bridge was hacked! $SFUND plummeted, founders urgently offering rewards for help”
• “Fake job ads hide crypto hackers! Malicious software ModStealer steals user data, targeting cryptocurrency wallets”
• “Another DeFi protocol hacked? Lending protocol Moonwell suspected of attack, losses exceeding $1 million”

This article was originally published on BlockTempo, a leading blockchain news media outlet.