Chainlink Oracle Glitch Results in $1M Loss for Moonwell Amid DeFi Exploits

On November 4, a malfunction in Chainlink's oracle price feed allowed an attacker to exploit Moonwell’s lending protocol, leading to a significant loss of $1 million. This incident followed a separate attack on Balancer that resulted in the loss of $128 million, marking a tumultuous start to the month for decentralized finance (DeFi) as multiple protocols faced severe vulnerabilities.

Key Takeaways

A malfunction in Chainlink's oracle price feed mispriced 0.02 wrstETH, inflating its value to millions and enabling an attacker to drain funds before the protocol could react.
Moonwell has faced four major security breaches in three years, with this recent hack occurring just 24 hours after Balancer's $128 million exploit.
DeFi experienced a significant downturn, with two major protocols suffering losses totaling $129 million within just 48 hours.

Chainlink oracle glitch costs Moonwell $1M as DeFi suffers another exploit

The Incident: Chainlink Oracle Exploit

On November 4, an attacker executed a sophisticated oracle manipulation attack that targeted the Moonwell lending protocol on Base. They borrowed approximately 0.02 wrstETH, which was worth only a few cents, and used it as collateral. Due to a temporary malfunction in the Chainlink oracle price feed, this minor collateral was mistakenly valued at $5.8 million. The protocol accepted this inflated valuation, allowing the attacker to borrow over 20 wstETH against it.

How the hacker exploited Chainlink on Moonwell DeFi platform

Source: CertiK

The hacker performed the exploit a total of seven times within three hours, each instance generating approximately 24.5-24.9 ETH. Executing the steps within single blocks allowed the attacker to evade liquidation mechanisms, ultimately yielding a profit of 292 ETH (about $1.01 million). CertiK confirmed the exploit was rooted in the error of oracle pricing, underscoring the vulnerabilities associated with relying on infrastructure in DeFi lending protocols, despite Chainlink's core network remaining secure.

Impact on Total Value Locked and Token Value

Data from DefiLlama indicates that Moonwell's Total Value Locked (TVL) plummeted from $268 million to $213 million—an alarming $55 million decrease in just a matter of hours.

Moonwell TVL

Source: DefiLlama

Additionally, the value of the WELL token dropped by over 12%, bringing it down to around $0.012, coinciding with a broader decline of more than 1% in the cryptocurrency market.

Recurring Security Issues

Reports indicate that this incident marks Moonwell's fourth major hack in three years. Previous breaches include a $320,000 flash loan incident in December 2024 and a $1.7 million oracle exploit on October 10, 2025. With this latest loss, the timeline shows a troubling pattern of recurring vulnerabilities faced by the protocol.

Most concerning is the fact that in February 2025, Moonwell decided to discontinue its Immunefi bug bounty program, eliminating financial rewards for security researchers who could help identify vulnerabilities before malicious actors could exploit them.

A Troubling Week for DeFi

The Moonwell exploit capped off a disastrous 48 hours for the DeFi sector. On November 3, Balancer lost a staggering $128 million due to hackers exploiting access control weaknesses across multiple blockchains, including Ethereum and Arbitrum. Berachain was forced to halt its entire network in response to the crisis.

The combined losses across these two protocols total over $129 million in two days. The incidents revealed distinct vulnerabilities: Balancer faced issues with faulty access controls, while Moonwell was targeted due to problems with oracle infrastructure. This week’s events highlight that even well-established protocols are not immune to sophisticated attacks that exploit infrastructure dependencies and specific protocol weaknesses.