Post #11674

First-Ever Exploit of Vibe-Coded DeFi – Moonwell Loses $1.78M On February 15, a lending protocol Moonwell suffered a $1.78M bad debt incident — and the commit that caused it was co-authored by Claude Opus 4.6. What happened: cbETH’s oracle was misconfigured — priced at $1.12 (cbETH/ETH ratio) instead of ~$2,200 (cbETH/ETH × ETH/USD). The error triggered 1,096 cbETH liquidations and $1.78M in bad debt. Their GitHub PR confirms the faulty commit was co-authored by Claude Opus 4.6 — making this potentially the first documented 7-figure DeFi exploit linked to AI-written smart contract code. This wasn’t Moonwell’s first rodeo — the protocol had already suffered two prior oracle-related incidents: a $1.7M bad debt event with $12M in liquidations in October 2025, and a $3.7M bad debt loss in November 2025, both exploited by the same attacker who was actively scanning Moonwell for mispriced assets.​​​​​​​​​​​​​​​​ A critical reminder – AI-assisted Solidity development still demands rigorous human review — particularly for protocols managing hundreds of millions in user funds. Moonwell had $150M in TVL before this incident. It now sits at $130M in TVL, with users pulling nearly 20% of deposits in the aftermath. 🔗x.com/moonwelldefi/status/2023428077381169630 @TOP7ICO