Celo's Moola Market Loses $8.4M to Collateral Price Manipulation, Then Gets Most of It Back

Moola Market, a lending protocol built on Celo, became the latest DeFi platform to be hit by what one observer called a "highly profitable trading strategy" — and in the process became the first Celo-based protocol to land on the rekt.news leaderboard, entering at #63.

As with the Mango Markets incident the previous week, the attacker's method centered on manipulating the price of a collateral asset. This time the take came to $8.4 million.

Moola announced the incident on Twitter and appealed directly to the attacker — believed to have funded the operation through a centralized exchange — offering a bounty in exchange for returning the funds. Roughly six hours later, more than 90% of the stolen assets were sent back to Moola's multisig wallet. The attacker retained about $525,000 as a bounty, and of that amount, $37,000 was subsequently donated to charity — leaving open the question of whether this reflected genuine remorse or a plan to act as a whitehat all along. (Analysis credit: FrankResearcher.)

A low-tech price manipulation

Notably, the exploit required no smart contract code at all — just capital and a sequence of trades. Starting with roughly 243,000 CELO (about $180,000) in funding, the attacker deposited 60,000 CELO as collateral to borrow 1.8 million of MOO, Moola's native token. Because MOO could itself be posted as collateral to borrow other assets, the attacker then used the remaining CELO to buy up MOO on Ubeswap, driving its price sharply higher.

With the value of their MOO holdings artificially inflated, the attacker was able to borrow against it and drain the rest of the protocol's liquidity, withdrawing:

• 8.8M CELO ($6.5M)
• 765k cEUR ($0.7M)
• 1.8M MOO ($0.6M)
• 644k cUSD ($0.6M)

The attacker's address has been identified as 0x95b5579b323ddc6cd290bd4da6e56ba019588efc.

Aftermath and lessons

Beyond returning the bulk of the funds, the attacker — acting as a whitehat in this instance — also directed 50,000 CELO (about $37,000) of their bounty to Impact Market, an organization that provides basic income support to vulnerable families in developing countries.

Prolonged bear market conditions tend to make this kind of manipulation easier, since thinner liquidity lets attackers move prices with comparatively little capital — a risk compounded whenever smaller protocols let their own native tokens serve as collateral, tokens whose market value keeps shrinking the longer the downturn lasts. In response, Moola Market is now proposing to eliminate MOO as an accepted collateral asset through a governance vote. Even so, the episode underscores that any well-funded actor can currently probe the limits of DeFi lending markets — leaving the obvious question of where the next attack will land.