Moonwell 再遭 900 万美元攻击，一年内第四起
Moonwell’s latest $9M attack marks four incidents in a year
DeFi 安全事件，涉及价格操纵漏洞，影响面较大，建议关注 Moonwell 后续处理及 DeFi 借贷平台安全风险。
An attacker has drained almost $9 million worth of deposits from DeFi lending platform Moonwell, on the Base network.
一名攻击者从Base网络上的DeFi借贷平台Moonwell盗取了近900万美元的存款。
Blockchain security firm Blockaid flagged the attack approximately an hour after it began.
区块链安全公司Blockaid在攻击开始约一小时后标记了此次攻击。
Moonwell later acknowledged the incident, informing users that all borrow caps and MAMO and WELL supply caps had been cut to one wei, “preventing new borrowing and limiting the potential for further impact.”
Moonwell随后承认了该事件，并告知用户所有借款上限以及MAMO和WELL的供应上限已被削减至一个wei，“以防止新的借款并限制进一步影响的可能。”
Blockaid’s Exploit Detection identified suspicious activity against @MoonwellDeFi on Base.
Blockaid的漏洞检测在Base上识别到针对@MoonwellDeFi的可疑活动。
An attacker manipulated MAMO collateral pricing to borrow cbBTC from the mCBTC market.
攻击者操纵了MAMO抵押品定价，从mCBTC市场借出了cbBTC。
Observed impact so far: 50.6 cbBTC ($4.0M+) drained
目前观察到的影响：50.6 cbBTC（价值超过400万美元）被盗取。
More details to follow.
更多细节将随后公布。
— Blockaid (@blockaid_) August 27, 2026
— Blockaid (@blockaid_) 2026年8月27日
Read more: DeFi, meet Claude: Moonwell’s ‘vibe-coded’ oracle in $1.8M blowup
阅读更多：DeFi遇见Claude：Moonwell的‘氛围编码’预言机在180万美元的崩溃中
The simple price manipulation attack hinged on inflating the price of MAMO, a relatively illiquid token used for collateral on Moonwell, and borrowing against it.
这次简单的价格操纵攻击依赖于抬高MAMO的价格，这是一种在Moonwell上用作抵押品的相对缺乏流动性的代币，并以此进行借款。
The attacker reportedly spent $7 million on pumping MAMO’s price, selling it after the attack for an estimated loss of $3.8 million.
据报道，攻击者花费了700万美元来推高MAMO的价格，在攻击后出售，估计损失了380万美元。
The “borrowed” assets include cbBTC, USDC, WETH, and wstETH.
“借出”的资产包括cbBTC、USDC、WETH和wstETH。
While Blockaid’s alert initially put the damage at $4+ million, the losses continued to stack up. The attacker swapped the proceeds for non-freezable stablecoin DAI, 8.7 million of which sits in their Tornado Cash-funded Ethereum address.
尽管Blockaid的警报最初将损失定为400多万美元，但损失继续累积。攻击者将所得资金兑换为不可冻结的稳定币DAI，其中870万DAI存放在他们由Tornado Cash资助的以太坊地址中。
All is not well at Moonwell
Moonwell的情况并不乐观
Today’s loss marks Moonwell’s fourth incident in less than a year, all pricing-related.
今天的损失标志着Moonwell在不到一年内发生的第四起事件，且均与定价相关。
A price discrepancy during the October 10 market crash led to $12 million in liquidations and $1.7 million of bad debt.
10月10日市场崩盘期间的价格差异导致了1200万美元的清算和170万美元的坏账。
The following month, fallout from the Balancer hack led to issues with the wrsETH/ETH oracle, resulting in $3.7 million of bad debt.
接下来的一个月，Balancer黑客事件的余波导致了wrsETH/ETH预言机的问题，造成了370万美元的坏账。
Most recently, in February, a “vibe-coded” Moonwell contract valued cbETH at $1.12 (instead of 1.12 ETH) when its true value was around $2,200.
最近，在2月份，一个“氛围编码”的Moonwell合约将cbETH的价值定为1.12美元（而非1.12 ETH），而其真实价值约为2200美元。
The error led to sudden liquidations of cbETH-collateralized positions and saddled the market with $1.8 million worth of bad debt.
该错误导致cbETH抵押头寸突然被清算，并使市场背负了180万美元的坏账。
Got a tip? Send us an email securely via Protos Leaks. For more informed news and investigations, follow us on X, Bluesky, and Google News, or subscribe to our YouTube channel.
有线索吗？请通过Protos Leaks安全地发送电子邮件给我们。欲获取更多有见地的新闻和调查，请在X、Bluesky和Google News上关注我们，或订阅我们的YouTube频道。
The post Moonwell’s latest $9M attack marks four incidents in a year appeared first on Protos.
文章《Moonwell最新900万美元攻击事件标志着一年的第四起事件》首发于Protos。
更进一步：量化金融体系
看懂新闻只是起点——沿量化金融路径，把它变成能交付的工程能力