Moonwell: How a Thin Token and a Donation Trick Pulled $8.7 Million Out of a Lending Market on Base

A breakdown of the Moonwell exploit on Base from 27 August 2026. This was not a code bug. The attacker leaned on three weak spots at once: a spot price oracle on a thin token, an exchange rate that also counts tokens sent straight into the mToken contract, and a supply cap that only gets checked at mint time. Together they let manipulated MAMO collateral back about $11 million in borrowed cbBTC, WETH, USDC and wstETH, leaving roughly $9 million of bad debt behind. I walk through the numbers, the Compound v2 accounting habit that made the donation trick work, and why fixing only the oracle leaves the hole open.