Moonwell suffers governance attack, with attackers spending $1,800 to push malicious proposals, risking $1.08 million in funds.

Gate News: On March 26, the DeFi lending protocol Moonwell was subjected to a governance attack, putting over $1 million of user funds at risk. On-chain observers detected that an attacker spent approximately $1,800 to purchase about 40 million MFAM tokens and used their voting power to push a malicious governance proposal. The proposal aimed to transfer control of the protocol’s core contract to an address controlled by the attacker. The entire attack, from purchasing tokens and creating the proposal to passing the vote, took only about 11 minutes. The proposal has currently been enacted in Moonwell’s Moonriver deployment environment, involving the transfer of control over 7 lending markets, auditing firms, and oracles. If executed, the attacker could drain the protocol’s funds, risking the loss of approximately $1.08 million of user assets. Moonwell is a lending protocol based on Moonbeam and Moonriver, part of the Polkadot ecosystem. Previously, in February this year, the protocol experienced a bad debt of about $1.78 million due to an oracle configuration error.