Moonwell Apollo (MFAM)

Someone spent $1,808 to try to steal $1 million from Moonwell. They almost pulled it off.

Not with a smart contract exploit. Not with a bridge hack. With a governance vote.

@Moonwell is a lending protocol with $85M TVL across Moonbeam and Moonriver that deprecated on January 29, 2026.

On March 26:

▸ Attacker buys 40.17M MFAM for 1,600 MOVR ($1,808) at $0.000025 per token

▸ Files proposal "MIP-R39: Protocol Recovery - Admin Migration," title cloned from a legitimate community discussion (MIP #73) to avoid suspicion

▸ Self-votes past quorum with the purchased tokens

▸ Total time: 11 minutes

▸ If executed: admin control of 7 lending markets, the comptroller, and oracle transfers to an attacker-controlled contract with pre-coded drain transactions

▸ $1.08M in user funds exposed

Eleven minutes. Most lending protocol teams take longer to eat breakfast.

@blockful_io caught it: the proposal contract contained pre-configured drain transactions. Pass the vote, execute, funds leave automatically.

—

➠ Three

Someone spent $1,808 to try to steal $1 million from Moonwell. They almost pulled it off.

Not with a smart contract exploit. Not with a bridge hack. With a governance vote.

@Moonwell is a lending protocol with $85M TVL across Moonbeam and Moonriver that deprecated on January 29, 2026.

On March 26:

▸ Attacker buys 40.17M MFAM for 1,600 MOVR ($1,808) at $0.000025 per token

▸ Files proposal "MIP-R39: Protocol Recovery - Admin Migration," title cloned from a legitimate community discussion (MIP #73) to avoid suspicion

▸ Self-votes past quorum with the purchased tokens

▸ Total time: 11 minutes

▸ If executed: admin control of 7 lending markets, the comptroller, and oracle transfers to an attacker-controlled contract with pre-coded drain transactions

▸ $1.08M in user funds exposed

Eleven minutes. Most lending protocol teams take longer to eat breakfast.

@blockful_io caught it: the proposal contract contained pre-configured drain transactions. Pass the vote, execute, funds leave automatically.

—

➠ Three

Someone spent $1,808 to try to steal $1 million from Moonwell. They almost pulled it off.

Not with a smart contract exploit. Not with a bridge hack. With a governance vote.

@Moonwell is a lending protocol with $85M TVL across Moonbeam and Moonriver that deprecated on January 29, 2026.

On March 26:

▸ Attacker buys 40.17M MFAM for 1,600 MOVR ($1,808) at $0.000025 per token

▸ Files proposal "MIP-R39: Protocol Recovery - Admin Migration," title cloned from a legitimate community discussion (MIP #73) to avoid suspicion

▸ Self-votes past quorum with the purchased tokens

▸ Total time: 11 minutes

▸ If executed: admin control of 7 lending markets, the comptroller, and oracle transfers to an attacker-controlled contract with pre-coded drain transactions

▸ $1.08M in user funds exposed

Eleven minutes. Most lending protocol teams take longer to eat breakfast.

@blockful_io caught it: the proposal contract contained pre-configured drain transactions. Pass the vote, execute, funds leave automatically.

—

➠ Three