Lead · Latest News
A contract can be drained without a single bug — as long as the price it trusts is fake, it will faithfully execute against the wrong number.
Priyanka Rao
·
September 18, 2026
On August 27, 2026, lending protocol Moonwell, operating on Coinbase's Layer 2 network Base, lost approximately $8.7 million in just over three hours — and throughout the entire incident, the attacker never found a single line of vulnerable contract code, nor bypassed any smart contract access control. This incident is worth studying alongside oracle manipulation precisely because it...