Moonwell February 2026 exploit analysis
Moonwell's `redeemUnderlying` priced against the live utilisation, so the attacker redeemed from a thin liquidation collateral address and walked the inflated redemption out. DeFiHackLabs reconstructs the on-chain drain.
- Reported loss
- 1.78M USD, per DeFiHackLabs
- Occurred
- Logged
- Source
- DeFiHackLabs
Logged as “2026-02-15: Faulty Oracle on Moonwell”.
Analysis1 min read
Moonwell's lending market had a redeemUnderlying path priced against the live utilisation. The attacker called redeemUnderlying from a thin liquidation collateral address, walked the inflated redemption out.
DeFiHackLabs reconstructs the sequence against the live Base state; total loss is captured in the PoC.
What would have prevented it: a redeemUnderlying path that prices against a multi-block utilisation, not the live state.
Other exploits
- Curve LlamaLend exploit analysis 2 Mar 2026
- LAXO Token exploit analysis 22 Feb 2026
- XDKRecycle exploit analysis 16 Feb 2026
- Makina exploit analysis 20 Jan 2026
- SynapLogic exploit analysis 20 Jan 2026
- MTToken exploit analysis 12 Jan 2026
Query every incident yourself — free, no signup
Updated 14 Oct 2026. Figures are as reported by the sources listed above and are not independently verified.
The crypto data layer for humans, apps, and AI agents.
