Moonwell Hack: $1M Lost After Chainlink Flaw, WELL Crypto Slumps To 2025 Lows

Guy Fawkes 2025.11.05 3 min read

The timing of this week’s hacks is poor, with a heavy bearing on some of the best cryptos to buy. Following the Balancer hack, over $128 million was siphoned from multiple DeFi protocols. As a result, everyone is cautious. This is not helping crypto prices at all.

Today, Moonwell DeFi has fallen victim to yet another discouraging attack. Neither tens of millions were stolen, nor is there a risk of a mini-supply chain attack in the works, but it is still a dent to what’s a relatively new but promising crypto subsector.

As of November 4, Moonwell manages over $234 million in assets – up more than four times since early 2023. At peak, the DeFi protocol had a total value locked (TVL) of nearly $400 million. Assets Under Management (AuM) have been rapidly falling. It has since shrunk to current levels from approximately $350 million in early October.

Moonwell hack: Over $1M lost after a price manipulation exploit targeting Chainlink feeds. WELL crypto slips to 2025 lows

(Source: DefiLlama)

DISCOVER: 20+ Next Crypto to Explode in 2025

Moonwell DeFi Hack: Over $1M Lost, Blame Chainlink?

Today’s hack could be a confidence-shaking event. It could potentially accelerate capital outflow from the DeFi protocol.

According to blockchain security firm CertiK, Moonwell was exploited today for roughly $1 million following a flashloan attack that took advantage of faulty oracle price feeds from Chainlink.

The hacker targeted Moonwell’s smart contracts deployed on Base and Optimism layer-2s.

Specifically, a vulnerability was found in an off-chain oracle price feed supplied by Chainlink for the rsETH/ETH pair, which incorrectly reported the price of wrstETH, the restaked version of stETH on Lido, at over $5.8 million per token.

Moonwell hack: Over $1M lost after a price manipulation exploit targeting Chainlink feeds. WELL crypto slips to 2025 lows

(Source: CertiKAlert, X)

Notably, at spot rates, the current price of ETH, which is the underlying price being tracked by all staked or restaked versions, is trading at below $3,500.

Due to this oracle manipulation, the attacker, likely an MEV bot, inflated the perceived collateral value, allowing the address to take a substantial flash loan against otherwise dust deposits of just 0.02 wrstETH.

Simply because of the faulty oracle, the protocol valued the 0.02 wrstETH deposit at over $116,000. Using this overvalued collateral, the attacker went on to borrow 20 wstETH, effectively draining Moonwell’s wstETH reserves.

The attacker went on to repeat this process across multiple transactions, per CertiK, each time flash-loaning a small amount until successfully draining 295 ETH or roughly $1M by the time the flaw was flagged.

DISCOVER: 9+ Best High-Risk, High-Reward Crypto to Buy in 2025

The Bad News And The Good News

Unfortunately, this is not the first time Moonwell has lost money.

From what’s clear, its smart contracts are leaky, and a permanent solution is needed.

In December 2024, Moonwell lost $320,000 in a flash loan exploit after the attacker targeted its USDC lending contract.

On October 10, when crypto prices crashed, an exploit on its contract on Base led to a loss of over $1.7M.

For now, it remains to be seen what the Moonwell development team will do to fix the problem once and for all.

The good news, and perhaps a major reprieve, is that today’s loss is not a direct code hack but a price manipulation exploit. It is an assurance that its lending logic is still sound, but its reliance on external price feeds is what’s creating weakness.

Following news of this hack, WELL USDT crashed to all-time lows, extending losses from all-time highs to over -96%.

Moonwell hack: Over $1M lost after a price manipulation exploit targeting Chainlink feeds. WELL crypto slips to 2025 lows