What happened
On February 15, 2026, a cbETH oracle misconfiguration in Moonwell's Base markets caused liquidations and borrowing at a severely incorrect price, leaving approximately $1.78 million in bad debt.
The oracle configuration used the raw cbETH/ETH ratio instead of converting it to USD by multiplying it by ETH/USD. That caused cbETH to be reported near $1.12 rather than its intended market value of roughly $2,200.
How it happened
Because cbETH was reported near one dollar, liquidation bots could repay minimal debt to seize cbETH collateral; some users also supplied minimal collateral to borrow cbETH at the distorted price.
Protocol details
Security review history
- Halborn View report
Evidence
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
