Disclaimer: Information found on CryptoreNews is those of writers quoted. It does not represent the opinions of CryptoreNews on whether to sell, buy or hold any investments. You are advised to conduct your own research before making any investment decisions. Use provided information at your own risk.
CryptoreNews covers fintech, blockchain and Bitcoin bringing you the latest crypto news and analyses on the future of money.
The decentralized crypto lending protocol Moonwell has been compromised, resulting in the theft of $1.78 million due to an error made by artificial intelligence. This was reported by the smart contract auditor known as pashov on the social media platform X.
The vulnerability stemmed from code generated by the AI model Claude Opus 4.6, as indicated by the crypto expert. The issue arose from a flaw in the pricing oracle algorithm: the price of the cbETH asset was incorrectly calculated at $1.12 instead of its actual value of approximately $2200.
Claude Opus 4.6 wrote vulnerable code, leading to a smart contract exploit with $1.78M loss
cbETH asset’s price was set to $1.12 instead of ~$2,200. The PRs of the project show commits were co-authored by Claude – Is this the first hack of vibe-coded Solidity code? pic.twitter.com/4p78ZZvd67
Related Posts
— pashov (@pashov) February 17, 2026
This marks the second exploit of the crypto protocol in recent months. On November 4, an attacker drained approximately $1 million (295 ETH) from it. This incident was also linked to the exploitation of a vulnerability in the Chainlink pricing oracle for the rsETH/ETH pair.
The issue was related to the incorrect display of the collateral token wrstETH’s price. The oracle reported the token’s value as over $5.8 million, while the actual price of Ethereum did not exceed $3500. This allowed the hacker to artificially inflate the collateral value through a bot: 0.02 wrstETH was valued at $116,000. The attacker secured a loan of 20 wstETH, depleting the protocol’s reserves. By repeating this scheme across multiple transactions, the hacker withdrew 295 ETH, equivalent to $1 million at the November exchange rate.
In December 2024, the protocol lost $320,000 due to a flash loan attack, and in October of the same year, the damage from a similar attack on the Base network exceeded $1.7 million.
Experts from BlockSec had pointed out systemic issues in the oracle settings as a key reason for these incidents back in November. Specifically, it was noted that outdated data update intervals create vulnerabilities that can be exploited by attackers.
Recently, another lending protocol, ZeroLend, announced its shutdown. Among the reasons cited by the developers were the rise in vulnerabilities and the increasing number of hacking incidents targeting such platforms.
