An intruder attempted to take control of the Moonwell protocol., 2026/03/27 11:30:55

27

An attacker attempted to seize control of the Moonwell protocol0

An unidentified individual acquired approximately 40 million MFAM governance tokens of the Moonwell lending protocol, spending around $1800. This enabled them to gather a quorum and present a governance proposal for the protocol, as reported by The Block.

In such instances, decisions are made by token holders. If the proposal receives approval, administrative control over several components of the protocol, including lending markets, the controller contract, and the price oracle, could be transferred to the contract associated with the proposal’s initiator.

The entire sequence of actions—token acquisition, proposal creation, and quorum achievement—took the attacker just 11 minutes. Voting remains open until March 27. At the time of publication, the majority of votes cast are against the proposal; however, the final outcome depends on participants who have yet to cast their votes.

This attack was made possible due to the characteristics of the token-based governance model. The Block notes that the MFAM token is trading at a low price, and participation from token holders in the voting process remains limited.

Moonwell is a lending protocol where users deposit assets to earn income or take out loans against collateral.

In February, the protocol had already encountered an incident related to a price oracle malfunction. At that time, the price of Coinbase Wrapped (cbETH) was reported at around $1 instead of the market value of approximately $2200, resulting in the creation of an unsecured debt of about $1.78 million.