Fact-check findings

The reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.

1. #2[disputed][awaiting moderator]in the summary

   “stolen funds were converted to DAI and routed through Tornado Cash”

   reviewerStolen funds were routed through Tornado CashSources say Tornado Cash funded the attacker beforehand. None say the stolen funds were routed through it. The page's own section 3 says the DAI stayed in the attacker's wallet, so the summary contradicts the body.
   Proposed correction (not yet applied)

   stolen funds were converted to DAI, and the attacker's wallet had been pre-funded through Tornado Cash
   citedcoinedition.com/moonwell-defi-hit-by-320…sks-highlighted/

No source the reviewer could reach confirms or contradicts the claim.

1. #4[unverifiable][awaiting moderator]in the timeline

   “2024-12-24”

   reviewerMoonwell disavowed MoonHacker on 2024-12-24The date of the Moonwell disavowal is not established. The timeline entry has an empty source.
2. #7[unverifiable][awaiting moderator]in section: December 2024 Exploit — Flash Loan and Logic Vulnerability

   “Dedaub noted that their automated monitoring tools had flagged the vulnerabilities — specifically the unchecked flashloan callback and unrestricted approve proxy — with high confidence in the days before the exploit occurred, but no remediation took place.”

   reviewerDedaub's monitoring flagged the vulnerabilities before the exploit, disclosed 2025-01-02The X post could not be read. The page's characterization that no remediation took place is an inference beyond what a tweet would show.
   citedx.com/dedaub/status/1874838342485102852
3. #9[unverifiable][awaiting moderator]in section: ZachXBT Flag and Broader Context

   “MoonHacker has been flagged by ZachXBT, the pseudonymous blockchain investigator known for tracking DeFi exploits, scams, and illicit fund flows.”

   reviewerMoonHacker flagged by ZachXBTThe page itself admits this flag is not independently sourced. I found nothing either, so it should be removed or sourced.
4. #10[unverifiable][awaiting moderator]in section: Team Response and Anonymity

   “The MoonHacker vault deployers had been contacted in an attempt to address the vulnerability and coordinate recovery, though no outcome was publicly confirmed.”

   reviewerDeployers were contacted to address the vulnerabilityNot found in the sources I read. SolidityScan was not fetched.
   citedblog.solidityscan.com/moonhacker-vault-h…sis-ab122cb226f6

The cited evidence supports part of the claim but not all of it.

1. #8[partially supported][awaiting moderator]in the timeline

   “Cyvers Alerts issues real-time alert identifying the attack on Moonwell's USDC lending contract on Optimism involving MoonHacker vault contracts.”

   reviewerCyvers Alerts issued an alert at the time of the exploitAlert is confirmed by title only. The 'involving MoonHacker vault contracts' framing is not checked, and the page frames the victim as Moonwell's contract while elsewhere saying Moonwell was unaffected.
   citedwww.chaincatcher.com/en/article/2158930

The cited evidence supports the claim as written.

1. #1[confirmed][no action needed]in the summary

   “On December 23, 2024, MoonHacker vault contracts suffered a flash loan exploit due to improper input validation and absent access controls in the executeOperation function, resulting in the loss of approximately $320,000 USDC.”

   reviewerOn Dec 23, 2024 MoonHacker vaults lost about $320,000 USDC to an exploit from improper input validation and missing access control in executeOperationVerichains and search results agree on date, amount and cause.
   citedblog.verichains.io/p/moonhacker-vault-hack-analysis
2. #3[confirmed][no action needed]in section: Protocol Overview

   “Moonwell DeFi has publicly clarified that MoonHacker vaults were independently deployed by third-party developers and are not affiliated with or endorsed by the Moonwell protocol or its team.”

   reviewerMoonwell stated MoonHacker vaults independently deployed and unaffiliatedConsistent with search results. I did not read the primary Moonwell post. CoinEdition says no official statement had been released at press time, so the timing is uncertain.
   citedblog.solidityscan.com/moonhacker-vault-h…sis-ab122cb226f6
3. #5[confirmed][no action needed]in section: On-Chain Forensics and Fund Movement

   “The attacker's wallet address is 0x36491840ebcf040413003df9fb65b6bc9a181f52.”

   reviewerAttack addresses and transaction hashThe attacker address, the truncated contract prefixes, the vault address and the tx hash all match Verichains.
   citedblog.verichains.io/p/moonhacker-vault-hack-analysis
4. #6[confirmed][no action needed]in section: On-Chain Forensics and Fund Movement

   “The attacker's wallet was pre-funded through Tornado Cash on the Ethereum mainnet prior to the attack”

   reviewerStolen USDC swapped to DAI and held in attacker wallet; wallet pre-funded via Tornado CashSupported by CoinEdition. The section cites different sources than the ones that carry the claim.
   citedcoinedition.com/moonwell-defi-hit-by-320…sks-highlighted/