Summary
MoonHacker is an independently deployed DeFi vault protocol built on Optimism that was designed to interact with the Moonwell lending protocol. On December 23, 2024, MoonHacker vault contracts suffered a flash loan exploit due to improper input validation and absent access controls in the executeOperation function, resulting in the loss of approximately $320,000 USDC. The Moonwell team confirmed no affiliation with MoonHacker, the vault deployers remain anonymous, and stolen funds were converted to DAI and routed through Tornado Cash, complicating recovery efforts.
Connected Entities
1 entitiesTimeline(5 events)
2024-12-23
MoonHacker vault contracts exploited on Optimism via flash loan and unchecked executeOperation callback; approximately $320,000 USDC drained.
2024-12-23
Cyvers Alerts issues real-time alert identifying the attack on Moonwell's USDC lending contract on Optimism involving MoonHacker vault contracts.
2024-12-23
Stolen USDC swapped to DAI and retained in attacker wallet; attacker wallet had been pre-funded via Tornado Cash on Ethereum.
2024-12-24
Moonwell DeFi publicly disavows any affiliation with MoonHacker, confirming core Moonwell lending pools are unaffected.
2025-01-02
Dedaub discloses on X that its monitoring tools had flagged the unchecked flashloan callback and unrestricted approve proxy vulnerabilities in MoonHacker with high confidence prior to the exploit.
Decision Log
- hash: B8VmanFxXULbZb5EUfcTY7G9vfs5wJ8Y2tZdXMdaboPa
This investigation is cryptographically anchored to the Solana blockchain and source URLs are archived via the Internet Archive.
model: claude-sonnet-4-6
generated: 5/4/2026, 2:54:26 AM
last updated: 5/30/2026, 4:47:49 AM
avoid.net — verified advice for a post-truth world