Core

DeFi

Moonwell

Base

Balancer

<p>Moonwell, the DeFi lending protocol operating on Base and Optimism, has denied reports of a new $1 million exploit, stating that the incident stemmed from a misreported oracle price rather than an active hack.</p>
<p>Earlier today, several blockchain security firms <a href="https://www.cryptotimes.io/2025/11/04/moonwell-hit-by-1m-oracle-exploit-on-base-and-optimism/" target="_blank" rel="noopener noreferrer nofollow">flagged</a> what appeared to be another attack on Moonwell’s oracle systems, its fourth major security event in three years. CertiK and QuillAudits initially reported that a faulty data feed had allowed an attacker to borrow funds by exploiting inflated prices for wrapped restaked ETH (wrsETH), prompting fears of another large-scale DeFi breach.</p>
<p>However, Moonwell later issued an official statement clarifying the situation. “We are currently investigating a misreported price for wrsETH,” the team said on X. “The risk manager for the wrsETH Core Market on Base and OP Mainnet has significantly reduced the supply and borrow caps in these markets.”</p>
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper">
  <blockquote class="twitter-tweet">
   <p>We are currently investigating a misreported price for wrsETH.<br><br>The risk manager for the wrsETH Core Market on Base and OP Mainnet has significantly reduced the supply and borrow caps in these markets.<br><br>We will share more information as it becomes available.</p>— Moonwell (@MoonwellDeFi) <a href="https://twitter.com/MoonwellDeFi/status/1985724613134024928?ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">November 4, 2025</a>
  </blockquote>
 </div>
</figure>
<h2 class="wp-block-heading" id="no-active-exploit-says-developer">No active exploit, says developer</h2>
<p>DeFi developer Luke Youngblood, commenting on X, reinforced the clarification: “It’s important to note there was no exploit or hack on Moonwell. This was a mispricing of wrsETH.”</p>
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper">
  <blockquote class="twitter-tweet">
   <p>It's important to note here there was no exploit or hack on Moonwell. This was a mispricing of wrsETH. Supply and borrow caps for this market on Base and OP Mainnet have been effectively zeroed out so the mispricing that occurred cannot be taken advantage of further. <a href="https://t.co/XrA9ByMu6N" rel="noopener noreferrer nofollow">https://t.co/XrA9ByMu6N</a></p>— LukeYoungblood.eth 🛡️ (@LukeYoungblood) <a href="https://twitter.com/LukeYoungblood/status/1985744006278758522?ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">November 4, 2025</a>
  </blockquote>
 </div>
</figure>
<p>The issue appears to have originated from an oracle error that temporarily distorted price data for wrsETH, causing automated systems to register abnormal valuations. By freezing affected pools and reducing borrowing limits to near zero, Moonwell effectively prevented further market manipulation.</p>
<h2 class="wp-block-heading" id="ongoing-investigations-amid-defi-volatility">Ongoing investigations amid DeFi volatility</h2>
<p>The timing of the incident added to market anxiety, coming less than 24 hours after the <a href="https://www.cryptotimes.io/2025/11/03/balancer-protocol-hit-by-major-exploit-resulting-in-128m-loss/" target="_blank" rel="noopener noreferrer nofollow">$116 million Balancer exploit</a>. Both events highlight how deeply DeFi platforms depend on accurate oracle feeds and automated market functions that can fail catastrophically when data becomes unreliable.</p>
<p>Moonwell said it is working “with leading security researchers” to find the cause and will publish a full report. The team maintains that no funds were lost, though parts of the DeFi community dispute that claim.</p>
<p>According to independent researcher @SpecterAnalyst, the same address had previously exploited Moonwell on October 10, stealing 269 ETH (roughly $1 million). Specter claims the attacker returned during this latest incident and siphoned an additional 295 ETH (~$1.1 million), bringing the total loss to over $2 million.</p>
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper">
  <blockquote class="twitter-tweet">
   <p>The <a href="https://twitter.com/MoonwellDeFi?ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">@MoonwellDeFi</a> attacker had previously exploited the protocol on October 10, stealing 269 <a href="https://twitter.com/search?q=%24ETH&amp;src=ctag&amp;ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">$ETH</a> (~$1M). It seems the team was unaware of the initial exploit or yet to fix it, as the attacker returned today and stole another 295 <a href="https://twitter.com/search?q=%24ETH&amp;src=ctag&amp;ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">$ETH</a> (~$1.1M).<br><br>In total, the team has lost over… <a href="https://t.co/xoEMOjEOwk" rel="noopener noreferrer nofollow">pic.twitter.com/xoEMOjEOwk</a></p>— Specter (@SpecterAnalyst) <a href="https://twitter.com/SpecterAnalyst/status/1985666708686729323?ref_src=twsrc%5Etfw" target="_blank" rel="noopener noreferrer nofollow">November 4, 2025</a>
  </blockquote>
 </div>
</figure>
<p>If confirmed, this would contradict Moonwell’s statement that no funds were taken, raising questions about whether the initial issue was fully resolved.&nbsp;</p>
<h2 class="wp-block-heading" id="broader-implications-for-defi-risk">Broader implications for DeFi risk</h2>
<p>The incident highlights a familiar DeFi tension: public reassurances versus on-chain reality. Researchers warn that until Moonwell’s full audit is released, users should remain cautious.</p>
<p>Even without confirmed losses, oracle errors like this reveal how fragile automated systems remain. As restaking assets like wrsETH spread, one bad data point can ripple across networks in seconds.</p>
<p>Moonwell’s affected markets stay paused as developers verify prices and reset risk limits. Whether glitch or exploit, the case shows how DeFi failures often begin as quiet data mistakes before turning costly.</p>
<blockquote class="wp-block-quote is-layout-flow wp-block-quote-is-layout-flow">
 <p>Also read: <a href="https://www.cryptotimes.io/2025/11/04/balancer-attacker-begins-swapping-stolen-funds-for-eth/" target="_blank" rel="noopener noreferrer nofollow">Balancer Attacker Begins Swapping Stolen Funds for ETH</a></p>
</blockquote>

Moonwell Investigates wrsETH Price Misreporting

Table of Contents

The Crypto Times

Other articles published on Nov 4, 2025

Join our free newsletter for daily crypto updates!