According to The Block, the Moonriver deployment of the DeFi lending protocol Moonwell suffered a governance attack. The attacker spent approximately $1,800 to acquire about 40 million MFAM tokens and completed the full sequence—purchasing tokens, submitting a proposal, and achieving quorum—in just under 11 minutes. If executed, this malicious proposal would transfer governance control of seven lending markets, the comptroller, and oracles to a contract controlled by the attacker, enabling the extraction of approximately $1.08 million in user funds. Voting is scheduled to conclude on March 27; while most votes have now shifted to oppose, the final outcome remains uncertain. The protocol includes a "Break Glass Guardian" emergency multisig mechanism that can intervene before the proposal is executed. This incident again highlights structural risks in decentralized governance, including unequal token distribution and low participation. Notably, Moonwell previously suffered an $1.8 million bad debt loss in February 2026 due to an oracle configuration error.
DeFi Protocol Moonwell Faces Low-Cost Governance Attack, Over $1 Million at Risk
TechFlowShare
Summary
A DeFi exploit has emerged as the Moonwell protocol update faces a low-cost governance attack on its Moonriver deployment. An attacker spent $1,800 to purchase 40 million MFAM tokens and submitted a proposal to seize control of seven lending markets, the comptroller, and oracles. If passed, the attacker could extract $1.08 million in user funds. The vote runs until March 27, with most votes currently opposing the proposal. Moonwell’s Break Glass Guardian multisig may intervene. This DeFi exploit underscores risks in decentralized governance, including low participation and uneven token distribution. The protocol previously lost $1.8 million in February 2026 due to an oracle error.
Source:Show original
Disclaimer: The information on this page may have been obtained from third parties and does not necessarily reflect the views or opinions of KuCoin. This content is provided for general informational purposes only, without any representation or warranty of any kind, nor shall it be construed as financial or investment advice. KuCoin shall not be liable for any errors or omissions, or for any outcomes resulting from the use of this information.
Investments in digital assets can be risky. Please carefully evaluate the risks of a product and your risk tolerance based on your own financial circumstances. For more information, please refer to our Terms of Use and Risk Disclosure.