Incident Overview
On February 15, 2026, Moonwell DeFi lending protocol on Base suffered a $1.78M loss when a cbETH price oracle was incorrectly configured to show $1.12 instead of $2,200, triggering mass liquidations where bots repaid minimal debt to receive 1,096.317 cbETH per transaction. The vulnerable code was reportedly co-authored with Claude Opus 4.6 AI, marking potentially the first major exploit of "vibe-coded" Solidity smart contracts.
The oracle configuration error occurred in the cbETH price feed formula, where instead of multiplying the cbETH/ETH exchange rate by the ETH/USD price to determine the dollar value, the system only transmitted the token ratio. This resulted in the oracle reporting cbETH at approximately $1.12 rather than its actual market price of ~$2,200—an error of over 99.9%. The drastically undervalued collateral triggered automatic liquidations across the protocol.
Trading bots exploited the mispricing by repaying approximately $1 worth of debt and receiving 1,096.317 cbETH in return for each liquidation, wiping out borrowers' collateral while leaving significant debt on their positions. Simultaneously, other users deposited minimal collateral to borrow cbETH at the artificially low price. The incident affected users holding cbETH, cbBTC, tBTC, and ETH as collateral, with many maintaining healthy loan-to-value ratios prior to liquidation.
Upon discovery, Moonwell's risk manager immediately reduced the cbETH borrowing limit to 0.01 to prevent further exploitation. The code commits were co-authored with Claude Opus 4.6 AI, raising questions about AI-assisted "vibe coding" in smart contract development, though experts noted human developers and auditors ultimately bear responsibility for reviewing AI-generated code.
cbETH (primary), cbBTC, tBTC
Incident Report
Protocol Information
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to Moonwell Lending, these are the critical security checks that could have prevented this incident (February 2026).
- Verify all logic paths related to cbETH Collateral Exploit / Oracle Issue are guarded by proper access controls and input validation - see the Oracle Manipulation & Price Manipulation attack class for patterns
- Audit oracle price feeds for manipulation risks - ensure time-weighted average prices (TWAPs) or multi-source aggregators are used, not spot prices
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialRelated Attack Classes
The technique used in this hack maps to these vulnerability classes in our security curriculum:
Sources & References
Learn to Prevent the Next Moonwell Lending
The Moonwell Lending hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.