{"investigation":{"slug":"molt-evm","entity_name":"Molt EVM","trust_score":22,"severity_base":null,"score_modifier":0,"confidence":0.62,"status":"published","content_type":"investigation","summary":"Molt EVM (ticker: mEVM) is an ERC-20 token deployed on the Base blockchain and traded via the Aerodrome decentralized exchange. On March 7, 2026, the protocol suffered a critical access-control exploit in which an attacker bypassed the onlySpawnerToken minting guard by directly overwriting the unprotected setSpawnerToken() function, minting approximately 31.5 quintillion mEVM tokens and swapping them for roughly $127,000 in WETH. ZachXBT has flagged the entity, and the token price collapsed to near zero following the incident.","sections":[{"content":"Molt EVM (mEVM) is an ERC-20 token deployed on the Base blockchain. The token traded on the Aerodrome decentralized exchange against WETH in a dedicated liquidity pool (pool address: 0x064c9fbed2cce0fdc3600777492bc0413b2cf95e). The project operates within the broader Molt ecosystem, which includes Moltbook — a Reddit-style social platform for autonomous AI agents launched on January 28, 2026, by entrepreneur Matt Schlicht. The mEVM token is distinct from the MOLT governance token (contract: 0xB695559b26BB2c9703ef1935c37AeaE9526bab07) issued directly by Moltbook. Details about the founding team behind the mEVM token specifically, its roadmap, and its stated utility remain limited in publicly available sources. The token's smart contract implemented a spawner-based minting architecture, in which a designated spawner contract held sole authority to mint new tokens via a protected spawnTokens() function.","heading":"Project Overview","sources":[{"url":"https://dexscreener.com/base/0x064c9fbed2cce0fdc3600777492bc0413b2cf95e","name":"dexscreener.com","type":"other","credibility":3},{"url":"https://basescan.org/token/0xB695559b26BB2c9703ef1935c37AeaE9526bab07","name":"basescan.org","type":"other","credibility":3},{"url":"https://nomoslabs.io/archive/molt-evm-2026","name":"nomoslabs.io","type":"other","credibility":3}],"severity":"medium"},{"content":"On March 7, 2026, the Molt EVM token contract on Base was exploited through a textbook access-control failure. The contract's minting architecture used an onlySpawnerToken modifier that verified msg.sender == spawnerToken before permitting execution of the spawnTokens() function. However, the administrative function setSpawnerToken() — which controlled which address held the spawner role — contained no access-control modifier of its own, meaning any external caller could overwrite the authorized spawner address without restriction. An attacker exploited this oversight by deploying 40 separate exploit contracts across blocks 43084564 through 43084603 on Base. Each contract called triggerMint, which in turn invoked the unprotected setSpawnerToken() to designate itself as the authorized spawner, then immediately called spawnTokens() to mint approximately 787 quadrillion mEVM tokens. Across all 40 transactions, the attacker minted a total of approximately 31.5 quintillion mEVM tokens. The attacker address identified on-chain is 0xEB179B0179836c6B634056db60855234D6aF3338. All minted tokens were subsequently swapped for WETH via the Aerodrome mEVM/WETH liquidity pool at block 43084941, netting approximately $127,000 in stolen funds. This type of vulnerability — where a modifier guards a sensitive operation but the function that sets authorization is left unprotected — is categorized as a missing access control bug and is listed among the most prevalent smart contract vulnerability classes.","heading":"Protocol Logic Exploit — onlySpawnerToken Modifier Bypass","sources":[{"url":"https://nomoslabs.io/archive/molt-evm-2026","name":"nomoslabs.io","type":"other","credibility":3},{"url":"https://dexscreener.com/base/0x064c9fbed2cce0fdc3600777492bc0413b2cf95e","name":"dexscreener.com","type":"other","credibility":3}],"severity":"medium"},{"content":"On-chain investigator ZachXBT flagged Molt EVM as a notable risk entity. The specific nature and date of ZachXBT's public statement regarding Molt EVM specifically have not been independently confirmed via a retrievable Tier 1 or Tier 2 primary source at this time; the flag is acknowledged by AVOID.NET as an input signal but cannot be fully substantiated from available public archives. ZachXBT has separately reported on broader EVM wallet draining incidents in January 2026 that resulted in over $107,000 stolen across more than 20 EVM chains, though those incidents are distinct from the Molt EVM exploit described above.","heading":"ZachXBT Flag","sources":[{"url":"https://thedefiant.io/news/hacks/zachxbt-reports-evm-hack-affecting-hundreds-of-wallets","name":"thedefiant.io","type":"other","credibility":3},{"url":"https://www.theblock.co/post/384118/crypto-wallets-drained-zachxbt","name":"theblock.co","type":"other","credibility":3}],"severity":"medium"},{"content":"Following the March 7, 2026 exploit, the mEVM token price collapsed to near zero. DEX Screener data shows the mEVM/WETH pair on Aerodrome trading at approximately $0.0000000000004397 per mEVM after the incident, representing a near-total loss of value for holders. The exploit effectively inflated the circulating supply by approximately 31.5 quintillion tokens — an astronomical dilution that destroyed the token's market price. Liquidity was drained from the Aerodrome pool as the attacker swapped all minted tokens for WETH. There is no publicly documented recovery plan, token migration, or compensation mechanism issued by the Molt EVM team in available sources.","heading":"Token Price and Market Impact","sources":[{"url":"https://dexscreener.com/base/0x064c9fbed2cce0fdc3600777492bc0413b2cf95e","name":"dexscreener.com","type":"other","credibility":3},{"url":"https://nomoslabs.io/archive/molt-evm-2026","name":"nomoslabs.io","type":"other","credibility":3}],"severity":"medium"},{"content":"The Molt EVM exploit exemplifies a class of vulnerabilities where access-control modifiers are applied to sensitive operations but the functions that determine authorization are themselves left without restriction. No evidence of a pre-launch security audit by a recognized smart contract auditing firm has been identified in available public sources. The contract was written in Solidity and deployed on the Base mainnet. The failure to protect the setSpawnerToken() administrative function represents a fundamental security design error that is detectable by standard automated analysis tools and manual review. The broader Moltbook ecosystem — though separate from the mEVM token — also suffered a distinct security breach disclosed in February 2026, in which Wiz security researchers found that over 6,000 owner email addresses and more than one million credentials were exposed due to insufficient authentication and authorization controls on the Moltbook platform, suggesting a pattern of security oversight across entities operating under the Molt brand.","heading":"Smart Contract Security Assessment","sources":[{"url":"https://nomoslabs.io/archive/molt-evm-2026","name":"nomoslabs.io","type":"other","credibility":3},{"url":"https://cyberindemnity.org/2026/02/when-vibe-coding-fails-security-lessons-from-the-moltbook-breach/","name":"cyberindemnity.org","type":"other","credibility":3}],"severity":"medium"},{"content":"The Molt ecosystem encompasses several distinct projects that share branding. Moltbook (MOLT token, contract 0xB695559b26BB2c9703ef1935c37AeaE9526bab07 on Base) is a social platform for autonomous AI agents founded by Matt Schlicht, with 27,880 token holders and a circulating market cap of approximately $1.47 million as of available data. Moltbook launched on January 28, 2026, and experienced its own security incident in February 2026 related to exposed infrastructure. The mEVM token appears to be a separate community-issued or derivative token inspired by the Molt brand, rather than an official Moltbook product. Moltbot, another entity under the Molt umbrella, has been separately flagged by Kaspersky and Noma Security for exposed control panels and agentic security risks unrelated to the mEVM exploit. These overlapping but legally distinct entities share nomenclature and community overlap, which may cause confusion among retail participants.","heading":"Ecosystem Context and Related Entities","sources":[{"url":"https://www.kaspersky.com/blog/moltbot-enterprise-risk-management/55317/","name":"kaspersky.com","type":"other","credibility":3},{"url":"https://noma.security/blog/moltbot-the-agentic-trojan-horse/","name":"noma.security","type":"other","credibility":3},{"url":"https://basescan.org/token/0xB695559b26BB2c9703ef1935c37AeaE9526bab07","name":"basescan.org","type":"other","credibility":3},{"url":"https://cyberindemnity.org/2026/02/when-vibe-coding-fails-security-lessons-from-the-moltbook-breach/","name":"cyberindemnity.org","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2026-01-28","event":"Moltbook platform launches on Base blockchain, founded by Matt Schlicht. MOLT governance token issued with 100 billion fixed supply.","source":""},{"date":"2026-02-03","event":"Wiz security researchers disclose a data exposure on the Moltbook platform affecting over 6,000 owner emails and more than 1 million credentials, attributed to insufficient access controls and rapid AI-assisted development practices.","source":""},{"date":"2026-03-07","event":"Molt EVM (mEVM) token on Base chain exploited via unprotected setSpawnerToken() function. Attacker (0xEB179B0179836c6B634056db60855234D6aF3338) deploys 40 exploit contracts across blocks 43084564–43084603, mints approximately 31.5 quintillion mEVM tokens, and swaps them for WETH via Aerodrome, stealing approximately $127,000.","source":""},{"date":"2026-03-07","event":"mEVM token price collapses to near zero following the exploit-driven supply inflation and liquidity drain.","source":""}],"sources_used":[{"url":"https://dexscreener.com/base/0x064c9fbed2cce0fdc3600777492bc0413b2cf95e","name":"dexscreener.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://basescan.org/token/0xB695559b26BB2c9703ef1935c37AeaE9526bab07","name":"basescan.org","type":"other","archive_url":"http://web.archive.org/web/20260508060438/https://basescan.org/token/0xB695559b26BB2c9703ef1935c37AeaE9526bab07","credibility":3,"archive_timestamp":"2026-05-08T06:04:38+00:00"},{"url":"https://nomoslabs.io/archive/molt-evm-2026","name":"nomoslabs.io","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://thedefiant.io/news/hacks/zachxbt-reports-evm-hack-affecting-hundreds-of-wallets","name":"thedefiant.io","type":"other","archive_url":"http://web.archive.org/web/20260325155222/https://thedefiant.io/news/hacks/zachxbt-reports-evm-hack-affecting-hundreds-of-wallets","credibility":3,"archive_timestamp":"2026-03-25T15:52:22+00:00"},{"url":"https://www.theblock.co/post/384118/crypto-wallets-drained-zachxbt","name":"theblock.co","type":"other","archive_url":"http://web.archive.org/web/20260113072119/https://www.theblock.co/post/384118/crypto-wallets-drained-zachxbt","credibility":3,"archive_timestamp":"2026-01-13T07:21:19+00:00"},{"url":"https://cyberindemnity.org/2026/02/when-vibe-coding-fails-security-lessons-from-the-moltbook-breach/","name":"cyberindemnity.org","type":"other","archive_url":"https://web.archive.org/web/20260829031052/https://cyberindemnity.org/2026/02/when-vibe-coding-fails-security-lessons-from-the-moltbook-breach/","credibility":3,"archive_timestamp":"2026-08-29T03:10:52+00:00"},{"url":"https://www.kaspersky.com/blog/moltbot-enterprise-risk-management/55317/","name":"kaspersky.com","type":"other","archive_url":"http://web.archive.org/web/20260803121846/https://www.kaspersky.com/blog/moltbot-enterprise-risk-management/55317/","credibility":3,"archive_timestamp":"2026-08-03T12:18:46+00:00"},{"url":"https://noma.security/blog/moltbot-the-agentic-trojan-horse/","name":"noma.security","type":"other","archive_url":"http://web.archive.org/web/20260824045409/https://www.noma.security/blog/moltbot-the-agentic-trojan-horse","credibility":3,"archive_timestamp":"2026-08-24T04:54:09+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:12.863821+00:00","updated_at":"2026-08-29T12:34:14.879822+00:00"}}