{"investigation":{"slug":"moola-market","entity_name":"Moola Market","trust_score":28,"severity_base":null,"score_modifier":0,"confidence":0.82,"status":"published","content_type":"investigation","summary":"Moola Market is a decentralized lending protocol built on the Celo blockchain, founded in 2020 by Patrick Baron and backed by Polychain Capital. In October 2022, the protocol suffered a price manipulation exploit draining approximately $9.1 million, making it one of the largest DeFi incidents on Celo; over 93% of funds were returned by the attacker within hours in exchange for a roughly $500,000 bounty. The protocol subsequently relaunched with reduced collateral thresholds, but its TVL and MOO token value have declined sharply since the incident.","sections":[{"content":"On October 18, 2022, Moola Market was exploited for approximately $9.1 million through a price manipulation attack targeting its low-liquidity MOO governance token. The attacker, whose primary wallet was identified on-chain as 0x95B5579b323Ddc6cd290Bd4DA6e56BA019588EfC, initially funded the attack address with approximately 182,000 CELO sourced from Binance. The attacker then purchased roughly $45,000 worth of MOO tokens and deposited them as collateral to borrow CELO. By repeatedly cycling borrowed CELO back into MOO purchases, the attacker inflated the MOO/CELO price from approximately 0.02 to 0.73 CELO — a 6,400% increase — within a short window. Because Moola's lending contract relied on a real-time TWAP oracle sourced from Ubeswap, which had insufficient liquidity to resist the manipulation, the protocol treated the artificially inflated MOO as high-value collateral. The attacker then borrowed against this inflated collateral to drain protocol liquidity across four assets. CertiK noted the attacker 'exploited the protocol off of its design rather than using an external contract to abuse certain functions,' characterizing it as a logic/design vulnerability rather than a code bug. A similar manipulation had occurred simultaneously at Mango Markets on Solana.","heading":"October 2022 Price Manipulation Exploit","sources":[{"url":"https://www.coindesk.com/markets/2022/10/19/celo-protocol-moola-market-loses-over-10m-in-market-manipulation-attack","name":"coindesk.com","type":"other","credibility":3},{"url":"https://www.anchain.ai/blog/moola-market-exploit","name":"anchain.ai","type":"other","credibility":3},{"url":"https://www.certik.com/resources/blog/8ENVqveSYRcppTHOcxG29-moola-market","name":"certik.com","type":"other","credibility":3},{"url":"https://rekt.news/moola-markets-rekt","name":"rekt.news","type":"other","credibility":3},{"url":"https://quillaudits.medium.com/moola-market-9-million-price-manipulation-attack-quillaudits-728485ee5782","name":"quillaudits.medium.com","type":"other","credibility":3}],"severity":"medium"},{"content":"On-chain analysis identified four asset categories drained in the exploit. AnChain.AI tracked the following approximate totals: 8.8 million CELO (valued at approximately $6.5–6.6 million at the time), 765,000 cEUR (approximately $0.7 million), 1.8 million MOO (approximately $0.6–1.2 million), and 644,000 cUSD (approximately $0.6 million). Estimates of total losses varied across sources, ranging from $8.4 million to $10 million, reflecting the volatility of CELO and MOO prices during and immediately after the attack. The attacker's initial capital outlay was approximately $45,000–$243,000 in CELO, depending on the stage of measurement cited.","heading":"Stolen Assets Breakdown","sources":[{"url":"https://www.anchain.ai/blog/moola-market-exploit","name":"anchain.ai","type":"other","credibility":3},{"url":"https://rekt.news/moola-markets-rekt","name":"rekt.news","type":"other","credibility":3},{"url":"https://www.coindesk.com/markets/2022/10/19/celo-protocol-moola-market-loses-over-10m-in-market-manipulation-attack","name":"coindesk.com","type":"other","credibility":3},{"url":"https://crypto.news/moola-market-hacked-for-8-4million-93-1-of-stolen-funds-returned/","name":"crypto.news","type":"other","credibility":3}],"severity":"medium"},{"content":"Within approximately 10 minutes of Moola Market publicly announcing the exploit and inviting the attacker to negotiate, an individual identifying as the attacker contacted the team directly and confirmed possession of the private key to the exploited wallet. The Moola team also stated it contacted law enforcement shortly after discovering the incident. Negotiations resulted in the attacker returning 93.1% of stolen funds to the Moola governance multi-sig wallet. The attacker retained approximately 650,000 CELO as a bounty — estimated at roughly $500,000–$525,000 at the time. Notably, the attacker also donated approximately 50,000 CELO (roughly $37,000) to ImpactMarket, a Celo-based unconditional basic income protocol for financially under-banked communities that had been a Moola depositor. Moola did not publicly disclose the exact bounty figure in its official communications. The identity of the attacker was never publicly confirmed, and no arrests or charges have been reported.","heading":"Fund Return and Bounty Negotiation","sources":[{"url":"https://cointelegraph.com/news/moola-market-attacker-returns-most-of-9m-looted-for-500k-bounty","name":"cointelegraph.com","type":"other","credibility":3},{"url":"https://coinjournal.net/news/moola-market-hacker-returns-7-8-million-of-stolen-funds/","name":"coinjournal.net","type":"other","credibility":3},{"url":"https://quillaudits.medium.com/moola-market-9-million-price-manipulation-attack-quillaudits-728485ee5782","name":"quillaudits.medium.com","type":"other","credibility":3},{"url":"https://rekt.news/moola-markets-rekt","name":"rekt.news","type":"other","credibility":3},{"url":"https://beincrypto.com/benevolent-moola-market-defi-hacker-returns-9m-exploited-funds/","name":"beincrypto.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Security analysts across multiple firms identified the root cause as a design-level oracle vulnerability rather than a smart contract code bug. Moola relied on a TWAP price oracle for MOO sourced from Ubeswap, a decentralized exchange on Celo. Because MOO had low liquidity on Ubeswap, a relatively small capital base was sufficient to manipulate the spot and time-weighted price. QuillAudits and AnChain.AI both recommended that protocols use more robust decentralized oracles such as Chainlink or aggregate multiple independent price feeds, and that lending markets require collateral tokens to have deep underlying liquidity before being listed. CertiK drew a direct parallel to the Mango Markets exploit on Solana that occurred in the same month, noting both were design-level vulnerabilities in lending collateral valuation logic.","heading":"Protocol Design Vulnerability and Root Cause","sources":[{"url":"https://quillaudits.medium.com/moola-market-9-million-price-manipulation-attack-quillaudits-728485ee5782","name":"quillaudits.medium.com","type":"other","credibility":3},{"url":"https://www.certik.com/resources/blog/8ENVqveSYRcppTHOcxG29-moola-market","name":"certik.com","type":"other","credibility":3},{"url":"https://www.anchain.ai/blog/moola-market-exploit","name":"anchain.ai","type":"other","credibility":3},{"url":"https://www.investing.com/news/cryptocurrency-news/moola-market-loses-84-million-in-an-incredibly-simple-attack-2917091","name":"investing.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Following the exploit, Moola paused all protocol operations and submitted governance proposal ID 9 to reduce the loan-to-value (LTV) and liquidation threshold governing MOO's use as collateral, effectively removing MOO as a viable collateral asset. A subsequent governance proposal (Proposal 10) laid out the protocol restart plan. Key provisions included: transferring lending pool administration rights from MOO token holders to a 6-of-10 multisig address for faster emergency response; freezing the MOO reserve to prevent new deposits, borrows, or rate swaps; implementing a phased unpause (deposits and repayments first, then borrows and withdrawals); and providing a 48-hour grace period to allow existing borrowers to repay or top up collateral before liquidations resumed. Users who had withdrawn funds during the attack period faced pro-rata haircuts on mCELO and mcEUR balances, with MOO token compensation subject to a 12-month lock. The post-exploit debt recovery strategy drew on recovered attacker funds, protocol treasury holdings, and reclaimed attack-related mTokens.","heading":"Post-Exploit Governance and Protocol Restart","sources":[{"url":"https://moolamarket.medium.com/moola-market-proposal-10-unpausing-f6d39d4208c4","name":"moolamarket.medium.com","type":"other","credibility":3},{"url":"https://cointelegraph.com/news/moola-market-attacker-returns-most-of-9m-looted-for-500k-bounty","name":"cointelegraph.com","type":"other","credibility":3},{"url":"https://ambcrypto.com/moola-markets-exploit-its-an-october-turned-hacktober-for-the-crypto-market/","name":"ambcrypto.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Moola Market was founded in 2020 by Patrick Baron, who previously served as Managing Member of Validator Capital. The protocol is headquartered in San Francisco, California. Moola raised a $1.4 million seed round on March 1, 2021, backed by Polychain Capital, Flori Ventures, and angel investors. The protocol was a participant in Celo Camp Batch 2, placing second overall during demo day, and is a member of the Celo Alliance for Prosperity. Moola was described as the leading DeFi lending project on Celo at the time of the exploit, supporting CELO, cUSD (Celo Dollar), and cEUR (Celo Euro) as collateral and borrowing assets. Patrick Baron is also listed as a steward of the Celo Community Fund and as a GP at Vladiator Capital.","heading":"Background: Founding, Funding, and Celo Ecosystem","sources":[{"url":"https://moolamarket.medium.com/moola-raises-1-4m-seed-round-d7725601789a","name":"moolamarket.medium.com","type":"other","credibility":3},{"url":"https://www.celocamp.com/post/hero-story-moola","name":"celocamp.com","type":"other","credibility":3},{"url":"https://coin98.net/what-is-moola-market-moo","name":"coin98.net","type":"other","credibility":3}],"severity":"medium"},{"content":"As of 2025–2026, Moola Market remains operational but in a significantly diminished state. DeFiLlama data shows a total value locked (TVL) of approximately $1.1 million, compared to a peak TVL that preceded the October 2022 exploit. The MOO token's market capitalization has declined to approximately $54,500 with a circulating supply of approximately 73.8 million tokens. The protocol reports approximately 50,953 active loans with an average APY near 0%. The MOO token has experienced a reported 73.5% price decline over the prior year, per Kraken price data. No formal shutdown announcement has been made, and the Moola Market Twitter account and website remain active. The protocol's DeFiLlama listing notes prior security incidents.","heading":"Current Protocol Status and Token Performance","sources":[{"url":"https://defillama.com/protocol/moola-market","name":"defillama.com","type":"other","credibility":3},{"url":"https://www.kraken.com/prices/moola-market","name":"kraken.com","type":"other","credibility":3},{"url":"https://www.coinbase.com/price/moola-market","name":"coinbase.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Moola Market has been flagged by on-chain investigator ZachXBT in the context of the October 2022 exploit. ZachXBT is a widely cited pseudonymous blockchain investigator known for tracking crypto fraud, hacks, and scam activity. The specific nature and framing of ZachXBT's flagging of Moola Market is documented in AVOID.NET's internal intake queue. Independent verification of the exact ZachXBT post or thread referencing Moola Market was not located through public web search at the time of this investigation. The exploit itself is extensively documented by Tier 1 and Tier 2 crypto news sources.","heading":"ZachXBT Flag","sources":[{"url":"https://en.wikipedia.org/wiki/ZachXBT","name":"en.wikipedia.org","type":"other","credibility":3},{"url":"https://www.coindesk.com/markets/2022/10/19/celo-protocol-moola-market-loses-over-10m-in-market-manipulation-attack","name":"coindesk.com","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2020","event":"Moola Market founded by Patrick Baron in San Francisco, CA.","source":"","date_original":"2020-01-01"},{"date":"2021-03","event":"Moola raises $1.4 million seed round led by Polychain Capital and Flori Ventures.","source":"","date_original":"2021-03-01"},{"date":"2022-10-18","event":"Price manipulation exploit begins at approximately 16:04 UTC. Attacker wallet 0x95B5579b323Ddc6cd290Bd4DA6e56BA019588EfC inflates MOO token price 6,400% via Ubeswap and drains approximately $9.1 million across CELO, cEUR, cUSD, and MOO.","source":""},{"date":"2022-10-18","event":"Moola Market pauses all protocol operations and publicly announces exploit. Team contacts law enforcement.","source":""},{"date":"2022-10-18","event":"An individual identifying as the attacker contacts the Moola team within approximately 10 minutes of the public announcement and confirms possession of exploited funds. Negotiations begin.","source":""},{"date":"2022-10-18","event":"Attacker returns 93.1% of stolen funds to the Moola governance multi-sig wallet. Attacker retains approximately 650,000 CELO (~$500,000) as a bounty and donates approximately 50,000 CELO (~$37,000) to ImpactMarket.","source":""},{"date":"2022-10-19","event":"CoinDesk, CoinTelegraph, and other major crypto outlets publish full coverage of exploit and fund return.","source":""},{"date":"2022-10-19","event":"Moola submits governance proposal ID 9 to remove MOO as viable collateral by reducing LTV and liquidation thresholds.","source":""},{"date":"2022-11","event":"Moola publishes Proposal 10 (Unpausing), outlining protocol restart plan including admin multisig transition, phased unpause, and user compensation for haircut balances.","source":"","date_original":"2022-11-01"},{"date":"2023","event":"Protocol relaunches with revised governance structure and MOO reserve frozen. TVL and MOO token value begin sustained decline.","source":"","date_original":"2023-01-01"},{"date":"2025","event":"Moola Market TVL stands at approximately $1.1 million; MOO market cap approximately $54,500. Protocol remains operational but dormant.","source":"","date_original":"2025-01-01"}],"sources_used":[{"url":"https://www.coindesk.com/markets/2022/10/19/celo-protocol-moola-market-loses-over-10m-in-market-manipulation-attack","name":"coindesk.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://www.anchain.ai/blog/moola-market-exploit","name":"anchain.ai","type":"other","archive_url":"http://web.archive.org/web/20260314091956/https://www.anchain.ai/blog/moola-market-exploit","credibility":3,"archive_timestamp":"2026-03-14T09:19:56+00:00"},{"url":"https://www.certik.com/resources/blog/8ENVqveSYRcppTHOcxG29-moola-market","name":"certik.com","type":"other","archive_url":"https://web.archive.org/web/20260829145205/https://www.certik.com/blog/8ENVqveSYRcppTHOcxG29-moola-market","credibility":3,"archive_timestamp":"2026-08-29T14:52:05+00:00"},{"url":"https://rekt.news/moola-markets-rekt","name":"rekt.news","type":"other","archive_url":"http://web.archive.org/web/20260608212853/https://rekt.news/moola-markets-rekt","credibility":3,"archive_timestamp":"2026-06-08T21:28:53+00:00"},{"url":"https://quillaudits.medium.com/moola-market-9-million-price-manipulation-attack-quillaudits-728485ee5782","name":"quillaudits.medium.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://crypto.news/moola-market-hacked-for-8-4million-93-1-of-stolen-funds-returned/","name":"crypto.news","type":"other","archive_url":"http://web.archive.org/web/20251112205426/https://crypto.news/moola-market-hacked-for-8-4million-93-1-of-stolen-funds-returned/","credibility":3,"archive_timestamp":"2025-11-12T20:54:26+00:00"},{"url":"https://cointelegraph.com/news/moola-market-attacker-returns-most-of-9m-looted-for-500k-bounty","name":"cointelegraph.com","type":"other","archive_url":"http://web.archive.org/web/20250818162815/https://cointelegraph.com/news/moola-market-attacker-returns-most-of-9m-looted-for-500k-bounty","credibility":3,"archive_timestamp":"2025-08-18T16:28:15+00:00"},{"url":"https://coinjournal.net/news/moola-market-hacker-returns-7-8-million-of-stolen-funds/","name":"coinjournal.net","type":"other","archive_url":"https://web.archive.org/web/20260829125436/https://coinjournal.net/news/tron-price-whats-the-outlook-after-the-latest-dip/?dynamic","credibility":3,"archive_timestamp":"2026-08-29T12:54:36+00:00"},{"url":"https://beincrypto.com/benevolent-moola-market-defi-hacker-returns-9m-exploited-funds/","name":"beincrypto.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://www.investing.com/news/cryptocurrency-news/moola-market-loses-84-million-in-an-incredibly-simple-attack-2917091","name":"investing.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://moolamarket.medium.com/moola-market-proposal-10-unpausing-f6d39d4208c4","name":"moolamarket.medium.com","type":"other","archive_url":"http://web.archive.org/web/20251011075706/https://moolamarket.medium.com/moola-market-proposal-10-unpausing-f6d39d4208c4","credibility":3,"archive_timestamp":"2025-10-11T07:57:06+00:00"},{"url":"https://ambcrypto.com/moola-markets-exploit-its-an-october-turned-hacktober-for-the-crypto-market/","name":"ambcrypto.com","type":"other","archive_url":"http://web.archive.org/web/20250914094435/https://ambcrypto.com/moola-markets-exploit-its-an-october-turned-hacktober-for-the-crypto-market/","credibility":3,"archive_timestamp":"2025-09-14T09:44:35+00:00"},{"url":"https://moolamarket.medium.com/moola-raises-1-4m-seed-round-d7725601789a","name":"moolamarket.medium.com","type":"other","archive_url":"http://web.archive.org/web/20260412131922/https://moolamarket.medium.com/moola-raises-1-4m-seed-round-d7725601789a","credibility":3,"archive_timestamp":"2026-04-12T13:19:22+00:00"},{"url":"https://www.celocamp.com/post/hero-story-moola","name":"celocamp.com","type":"other","archive_url":"http://web.archive.org/web/20260514074917/https://www.celocamp.com/post/hero-story-moola","credibility":3,"archive_timestamp":"2026-05-14T07:49:17+00:00"},{"url":"https://coin98.net/what-is-moola-market-moo","name":"coin98.net","type":"other","archive_url":"http://web.archive.org/web/20260214021054/https://coin98.net/what-is-moola-market-moo","credibility":3,"archive_timestamp":"2026-02-14T02:10:54+00:00"},{"url":"https://defillama.com/protocol/moola-market","name":"defillama.com","type":"other","archive_url":"http://web.archive.org/web/20250915230020/https://defillama.com/protocol/moola-market","credibility":3,"archive_timestamp":"2025-09-15T23:00:20+00:00"},{"url":"https://www.kraken.com/prices/moola-market","name":"kraken.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:not-found","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.coinbase.com/price/moola-market","name":"coinbase.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://en.wikipedia.org/wiki/ZachXBT","name":"en.wikipedia.org","type":"other","archive_url":"http://web.archive.org/web/20260711020137/https://en.wikipedia.org/wiki/ZachXBT","credibility":3,"archive_timestamp":"2026-07-11T02:01:37+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:47.417765+00:00","updated_at":"2026-08-30T05:14:12.474903+00:00"}}