Incident Overview
On December 23, 2024, the MoonHacker vault contracts on Optimism were exploited for roughly $320,000 in USDC.
The attacker took out a flash loan in USDC from Aave and substituted a malicious contract for the mToken parameter in the MoonHacker vault’s executeOperation function. Because no validation prevented unauthorized addresses, the vault mistakenly granted approval to the attacker’s malicious contract. This facilitated a transfer of USDC from the vault, after which the attacker repeatedly called repayBorrow and redeem to siphon out remaining tokens.
They then repaid the flash loan, securing the stolen USDC in the process. MoonHacker deployers, who are unknown to Moonwell, are now working with relevant parties to investigate and recover the stolen funds. Importantly, no Moonwell core lending pools were compromised.
Exploit tx:
https://optimistic.etherscan.io/tx/0xd12016b2…54c4fe
Attacker address:
https://optimistic.etherscan.io/address/0x36491840…181f52
Incident Report
Protocol Information
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to MoonHacker, these are the critical security checks that could have prevented this incident (December 2024).
- Verify all logic paths related to Flash Loan Attack are guarded by proper access controls and input validation - see the Flash Loans Attacks attack class for patterns
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialRelated Attack Classes
The technique used in this hack maps to these vulnerability classes in our security curriculum:
Sources & References
Learn to Prevent the Next MoonHacker
The MoonHacker hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.