Verify a decision

{"actor":"system:backfill","investigation_id":"a9f1ce8e-0b15-4a1f-a9d0-6d8f5544dbf7","kind":"publish","page_slug":"moonwell-lending","published_at":"2026-05-27T19:45:45.832Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Moonwell Lending","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://nansen.ai/post/what-is-moonwell","type":"other","url":""},{"credibility":3,"name":"https://messari.io/project/moonwell","type":"other","url":""},{"credibility":3,"name":"https://news.bitcoin.com/lunar-labs-co-founder-luke-youngblood-talks-moonwell-artemis-and-over-collateralized-loans/","type":"other","url":""},{"credibility":3,"name":"https://www.coincarp.com/project/moonwell/","type":"other","url":""},{"credibility":3,"name":"https://defillama.com/protocol/moonwell","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://cointelegraph.com/news/moonwell-bad-debt-recovery-plebiscite-draws-user-controversy","type":"other","url":""},{"credibility":3,"name":"https://cryptonews.com/news/moonwells-bold-2-3m-plan-to-counter-frax-hack-debt-sparks-controversy/","type":"other","url":""},{"credibility":3,"name":"https://medium.com/@horatiolucas2/moonwell-finance-and-frax-finance-plan-to-appropriate-15m-users-assets-behind-a-controversial-dao-2912fcf62826","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://cointelegraph.com/news/moonwell-bad-debt-recovery-plebiscite-draws-user-controversy","type":"other","url":""},{"credibility":3,"name":"https://cryptonews.com/news/moonwells-bold-2-3m-plan-to-counter-frax-hack-debt-sparks-controversy/","type":"other","url":""},{"credibility":3,"name":"https://medium.com/@horatiolucas2/moonwell-finance-and-frax-finance-plan-to-appropriate-15m-users-assets-behind-a-controversial-dao-2912fcf62826","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://coinmarketcap.com/academy/article/2ff106ab-e90e-47b4-8403-627e3802508d","type":"other","url":""},{"credibility":3,"name":"https://coinedition.com/moonwell-defi-hit-by-320k-flash-loan-exploit-security-risks-highlighted/","type":"other","url":""},{"credibility":3,"name":"https://bitcoinethereumnews.com/tech/moonwell-defi-exploited-in-320k-flash-loan-attack/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.mexc.com/en-PH/news/154021","type":"other","url":""},{"credibility":3,"name":"https://coinfomania.com/moonwell-oracle-exploit-base-optimism/","type":"other","url":""},{"credibility":3,"name":"https://99bitcoins.com/news/altcoins/moonwell-hack-1m-lost-after-chainlink-flaw-well-crypto-slumps-to-2025-lows/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.web3isgoinggreat.com/?id=moonwell-oracle-malfunction","type":"other","url":""},{"credibility":3,"name":"https://www.halborn.com/blog/post/explained-the-moonwell-hack-november-2025","type":"other","url":""},{"credibility":3,"name":"https://coinfomania.com/moonwell-oracle-exploit-base-optimism/","type":"other","url":""},{"credibility":3,"name":"https://en.coinotag.com/moonwells-1m-oracle-exploit-raises-defi-security-concerns-well-token-falls-12/","type":"other","url":""},{"credibility":3,"name":"https://99bitcoins.com/news/altcoins/moonwell-hack-1m-lost-after-chainlink-flaw-well-crypto-slumps-to-2025-lows/","type":"other","url":""},{"credibility":3,"name":"https://ambcrypto.com/chainlink-oracle-glitch-costs-moonwell-1m-as-defi-suffers-another-exploit/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://decrypt.co/358374/oracle-error-leaves-defi-lender-moonwell-1-8-million-bad-debt","type":"other","url":""},{"credibility":3,"name":"https://cointelegraph.com/news/moonwell-exploit-cbeth-oracle-misprice-ai-commits-testing-audits","type":"other","url":""},{"credibility":3,"name":"https://www.cryptopolitan.com/claude-moonwell-smart-contract-exploit/","type":"other","url":""},{"credibility":3,"name":"https://financefeeds.com/moonwell-exploited-for-1-78-million-after-cbeth-oracle-mispricing/","type":"other","url":""},{"credibility":3,"name":"https://crypto.news/moonwells-ai-coded-oracle-glitch-misprices-cbeth-at-1-drains-1-78m/","type":"other","url":""},{"credibility":3,"name":"https://btcusa.com/moonwell-hack-1-78m-exploit-linked-to-ai-generated-oracle-bug/","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://crypto.news/moonwell-hit-by-governance-attack-1-08m-at-risk-for-1800-spend/","type":"other","url":""},{"credibility":3,"name":"https://www.web3isgoinggreat.com/?id=moonwell-governance-attack","type":"other","url":""},{"credibility":3,"name":"https://www.dlnews.com/articles/defi/attacker-spends-less-two-grand-to-hold-crypto-project-hostage/","type":"other","url":""},{"credibility":3,"name":"https://www.kucoin.com/news/flash/defi-lending-protocol-moonwell-faces-governance-attack-on-moonriver","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://www.halborn.com/audits/moonwell/smart-contract-assessment-409b83","type":"other","url":""},{"credibility":3,"name":"https://code4rena.com/audits/2023-07-moonwell","type":"other","url":""},{"credibility":3,"name":"https://forum.moonwell.fi/t/migrate-moonwells-bug-bounty-program-provider-from-immunefi-to-code4rena/1386","type":"other","url":""},{"credibility":3,"name":"https://ambcrypto.com/chainlink-oracle-glitch-costs-moonwell-1m-as-defi-suffers-another-exploit/","type":"other","url":""},{"credibility":3,"name":"https://docs.moonwell.fi/moonwell/protocol-information/audits","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://docs.moonwell.fi/moonwell","type":"other","url":""},{"credibility":3,"name":"https://messari.io/project/moonwell","type":"other","url":""}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"https://defillama.com/protocol/moonwell","type":"other","url":""},{"credibility":3,"name":"https://www.bitget.com/academy/moonwell-defi-guide","type":"other","url":""},{"credibility":3,"name":"https://x.com/QuillAudits_AI/status/1985654917898649840","type":"other","url":""}]}],"sources_used":[],"summary":"Moonwell is a decentralized, non-custodial lending and borrowing protocol deployed on Base, Optimism, Moonbeam, and Moonriver, operating as a fork of Compound v2. The protocol has suffered at least five distinct security incidents between 2022 and 2026, resulting in combined losses and bad debt exceeding $5 million, including repeated oracle failures, a flash loan exploit, a near-successful governance attack, and an AI-assisted smart contract misconfiguration. Despite multiple audits by Halborn and Code4rena, the pattern of recurring vulnerabilities and the removal of its Immunefi bug bounty program in early 2025 have raised significant security concerns.","timeline":[{"date":"2021-01-01","event":"Moonwell founded by Luke Youngblood under Lunar Labs; built as a Compound v2 fork targeting Moonbeam network","source":""},{"date":"2022-03-17","event":"Moonwell raises $10 million in Strategic funding round","source":""},{"date":"2022-08-02","event":"Nomad bridge exploited for $190.7 million; Moonwell's Moonbeam deployment suffers collateral losses and bad debt including approximately $2.9 million in Frax-related bad debt","source":""},{"date":"2023-07-24","event":"Code4rena competitive audit identifies 17 medium severity vulnerabilities and 56 low/informational issues; no critical or high severity findings","source":""},{"date":"2023-12-31","event":"Non-binding governance plebiscite passes 98% in favor of using Nomad collateral and protocol reserves to address Frax bad debt, drawing community controversy over asset appropriation","source":""},{"date":"2024-12-01","event":"Flash loan exploit on Optimism USDC market drains approximately $320,000 via a malicious mToken contract; stolen funds swapped to DAI","source":""},{"date":"2025-02-01","event":"Moonwell removes its Immunefi bug bounty program; proposes migration to Code4rena bug bounty platform","source":""},{"date":"2025-10-10","event":"Oracle-DEX price gap during market volatility allows exploitation of liquidation mechanisms on Base deployment; approximately $1.7 million lost","source":""},{"date":"2025-11-04","event":"Chainlink oracle malfunction misprices wrsETH at $5.8 billion; attacker drains approximately $1 million (295 ETH) within 30 seconds; $3.7 million in bad debt accrues; WELL token drops ~13.5%","source":""},{"date":"2026-02-15","event":"Governance proposal MIP-X43 deploys misconfigured Chainlink OEV oracle; cbETH mispriced at ~$1.12 instead of ~$2,200; $1.78 million in bad debt generated; AI-assisted code co-authored by Claude Opus 4.6 implicated","source":""},{"date":"2026-03-24","event":"Governance attack on Moonriver deployment: attacker spends $1,808 to acquire voting tokens, submits malicious proposal, reaches quorum in ~11 minutes; $1.08 million in assets placed at risk; community votes defeated the proposal","source":""},{"date":"2026-04-06","event":"DAO approves MIP-X49, implementing fixes to Wormhole V3 cross-chain integration following March 2026 upgrade (MIP-X48)","source":""}]},"v":1}