Moonwell MAMO exploit: 800 ETH from Tornado Cash in, 8.73 million DAI out, and the DAI has not moved for seven weeks

Moonwell is a lending protocol. On 27 August 2026 Blockaid flagged an attack on its Base deployment: the attacker drove the price of MAMO, a token with little liquidity, from about $0.01 up several times, used it as collateral and borrowed cbBTC, USDC, WETH and wstETH against it. PeckShield put the loss at about $8.7 million. Moonwell set the borrow caps of every core market on Base to one wei, which stopped all new borrowing.

The press found the holding wallet early. [Protos](https://protos.com/moonwells-latest-9m-attack-marks-four-incidents-in-a-year/) and others reported that about 8.7 million DAI sat on 0xD71dD9B6e634412713c47fe7aE02c628e338C384 on Ethereum, a wallet funded through Tornado Cash; Protos estimated the attacker’s net at about $5.2 million after the cost of pumping MAMO.

We went back to both chains seven weeks later. Below is what the two attacker wallets show, read on 15 October 2026.

The attack needed capital: money to buy MAMO and push its price up. All of it came from Tornado Cash. On 21 August 0xD71dD9B6e634412713c47fe7aE02c628e338C384 withdrew 0.098 ETH and then 100 ETH from Tornado’s 100 ETH pool. Nine minutes later it sent 99 ETH out through a LayerZero bridge contract, and about 99 ETH came back within the hour through Stargate and Across. Reports that describe the wallet as funded with 0.1 ETH from Tornado plus 99 ETH from bridges are reading that loop: the 99 ETH was the attacker’s own Tornado money sent round a bridge and back.

On 23 August the same wallet withdrew seven more 100 ETH notes, 700 ETH, between 00:26 and 01:47 UTC. That evening it tried eight times to sell 700 ETH through swap aggregators; every attempt failed. The ninth, a CoW Swap order at 23:10 UTC, filled for 1,715,095 USDC. Together with 232,296 USDC from the 99 ETH sold on 21 August, the wallet held 1,947,391 USDC, and at 01:23 UTC on 24 August it sent all of it to Base through Circle’s CCTP bridge, to the same address on Base.

On Base the wallet bought 7,407,608 MAMO for 75,000 USDC on 26 August, about one cent each. On the morning of 27 August it handed the attack wallet, 0x719eae70d4A83f35bF82A2740699F5db84BE919D, 7,989,608 MAMO and 1,862,291 USDC, and 0.0003 ETH for gas.

Between 08:18 and 09:33 UTC on 27 August the attack wallet entered Moonwell’s markets, pushed the price of MAMO up, posted MAMO as collateral and borrowed against it in dozens of transactions. It then sold everything it had borrowed or bought, cbBTC, wstETH, WETH and a long list of smaller tokens, through CoW Swap, Native, Uniswap and other pools, into USDC.

At 09:41 and 09:42 UTC it sent two transfers of 4,364,727 USDC, 8,729,454 in all, back to Ethereum through CCTP, again to its own address. Minutes later, at 09:44, it swapped the 8,728,319 USDC that arrived into DAI through ParaSwap and Maker’s PSM. Circle can freeze USDC on an address; nobody can freeze DAI. At 09:45 the DAI went to 0xD71dD9B6e634412713c47fe7aE02c628e338C384, the wallet that had paid for the attack.

Since then that wallet has sent nothing. It holds 8,728,319 DAI and 0.9 ETH. Everything arriving on it, and on the attack wallet, is dust and fake tokens from address-poisoning bots.

The cleanest way to measure the gain is to compare what the attacker brought to Base with what it took away. In: 1,947,391 USDC bought with about 799 ETH from Tornado. Out: 8,729,454 USDC, which became 8,728,319 DAI. What stayed behind on Base is small, about 3,700 USDC and 0.25 ETH on the attack wallet. So the attacker’s own gain is about $6.78 million, more than the $5.2 million estimated in the press.

The difference is the MAMO. The attacker bought its first 7.4 million MAMO for $75,000 before the attack, so most of what it spent on the price pump went into a token it had acquired cheaply and then left with Moonwell as collateral. The lenders’ loss, about $8.7 million, is a separate number: it is what the protocol lent out against collateral that turned out to be worth almost nothing.

The holding wallet 0xD71dD9B6e634412713c47fe7aE02c628e338C384 was already marked in our database from the news coverage. The attack wallet 0x719eae70d4A83f35bF82A2740699F5db84BE919D was not marked anywhere; we added it on 15 October, with both addresses under one incident. We did not mark Moonwell’s contracts, the bridges, the swap services or the address that sold MAMO.

The DAI wallet is on our watch list: any transaction it sends will reach us, and we will update this page. To check an address yourself, use the address check.

It does not say who the attacker is, and it does not say that Moonwell, the MAMO project, Circle, Maker, CoW Swap, the bridges or Tornado Cash did anything unlawful. The loss figure is PeckShield’s and Blockaid’s; the location of the DAI was first reported by the press. The 800 ETH funding, the route of the seed money, the arithmetic of the gain and the state of the wallets on 15 October are ours.