Moonwell cbETH Exploit: 1.78M$ AI Code Error

Moonwell, a DeFi lending protocol operating on Base and Optimism networks, suffered a $1.78 million exploit because the price oracle for Coinbase Wrapped Staked ETH (cbETH) returned approximately $1.12 instead of the correct $2,200 value. Attackers exploited this oracle error-induced price discrepancy using a flash loan attack to profit. The recent BlackRock staked ETH ETF application highlights the criticality of oracle security while boosting the popularity of wrapped ETH products like cbETH.

Technical Details of the Moonwell Attack

Affected contracts had insufficient oracle integration; the low price display undervalued collateral, leading to over-borrowing. Security auditor Pashov detected commits from the Anthropic Claude Opus 4.6 model in pull requests. The developer used AI for Solidity coding, but the lack of end-to-end integration tests created the vulnerability. Pashov: “Even if it was a senior developer error, blockchain-integrated tests would have caught it.” The team defended the Halborn audit.

AI Code Risks and DeFi Lessons

• Main cause: Oracle price error ($1.12 vs $2,200)
• Attack method: Debt exploitation via price manipulation
• AI impact: Claude commits went unsupervised
• Recommendation: Rigorous testing + manual review (cheqd CEO Edwards)

The Moonwell incident shows that AI coding must be supported by disciplined processes.

Critical Support and Resistance Levels for ALT

DeFi exploits are increasing pressure on altcoin markets. ALT: $0.01 (-2.51%), RSI 39.33 (downtrend, Supertrend bearish).

• S1: $0.0082 (⭐ Strong, -4.21%)
• S2: $0.0069 (⭐ Strong, -19.39%)
• R1: $0.0091 (⭐ Strong, +6.31%, EMA20)
• R2: $0.0096 (⭐ Strong, +12.15%)

For detailed charts, check ALT detailed analysis and ALT futures. Optimism (OP) network was affected; OP analysis.

Frequently Asked Questions About the Moonwell Exploit

How did the Moonwell exploit happen?

The cbETH oracle showed a low price, and attackers exploited the discrepancy.

How did AI code harm Moonwell?

Claude Opus commits were merged without testing, creating an integration gap.

What should DeFi users do?

Prefer audited protocols and check oracle security.