Moonwell's cbETH Oracle Bug: A Missing Multiplication, an AI Co-Author, and $1.78 Million in Bad Debt

A single absent multiplication step in a price feed cost lending protocol Moonwell $1.78 million in under four minutes on February 15. The oracle for cbETH, a liquid staking token, published the cbETH/ETH exchange rate — roughly 1.12 — as if it were already a dollar figure, instead of multiplying it by the live ETH/USD price. An asset actually worth close to $2,200 suddenly read as $1.12 on-chain, a roughly 99.9% understatement, and liquidation bots reacted immediately.

What makes this incident stand apart from a typical DeFi exploit write-up is its origin: the pull request that introduced the flaw was co-authored by Anthropic's Claude Opus 4.6, and the model's involvement became public knowledge almost as fast as the bad debt did.

01How the mispricing happened

At 6:01 PM UTC on February 15, Moonwell's governance executed proposal MIP-X43, an otherwise unremarkable upgrade meant to turn on Chainlink OEV wrapper contracts across the protocol's core markets on Base and Optimism, part of a broader push to capture oracle extractable value. Buried in that upgrade was a single misconfigured price feed.

cbETH's value in dollars requires two inputs: the cbETH/ETH ratio (around 1.12, reflecting accrued staking rewards) multiplied by the ETH/USD price. The oracle that shipped with MIP-X43 dropped the second step, reporting the raw 1.12 ratio as a dollar price. A token worth roughly $2,200 was suddenly valued at $1.12 on-chain — visible to anyone, including automated liquidators.

02The four-minute cascade

Liquidation bots did not need to be told twice. Within the same block as the bad price went live, automated liquidators began closing out every cbETH-backed loan on the protocol. The trade was trivial: repay a dollar of debt, walk away with a cbETH token actually worth $2,200. Repeated at scale, this stripped 1,096.317 cbETH from borrowers, leaving their positions wiped of collateral but still carrying residual debt.

A second, smaller group worked the opposite side of the same broken number: posting minimal collateral and borrowing cbETH at its artificially depressed price, then exiting with the difference.

The entire window between MIP-X43's execution and containment lasted four minutes — the time it took Anthias Labs to spot the discrepancy and slash the borrow cap to 0.01. By then the damage was largely locked in. Liquidations kept trickling in afterward, too, because fixing the oracle itself required a five-day governance vote and timelock that could not be fast-tracked.

03Where the bug came from

Pull request #578, submitted by contributor anajuliabit, was meant to extend the Chainlink OEV wrapper rollout to the remaining Base and Optimism markets. GitHub's Copilot reviewed all four changed files and left four comments; the PR then passed human review, merged, and went to a governance vote, where it passed with 99.1% support.

The commit trailer read: "Co-Authored-By: Claude Opus 4.6" — a line that would circulate widely once security researchers noticed it.

Claude's actual contributions to the PR were narrow and, on their face, sound: tightening int256 validation, adding a try/catch around chainlinkOracle() so redundant redeployments were skipped when two configs shared an oracle, removing an unused ProxyAdmin import, and adding an assertTrue(answer > 0) check to catch negative oracle prices. None of that touched the actual defect.

What nobody caught — not Claude, not Copilot, not the human reviewers, not the 99.1% of governance voters who approved it — was that the cbETH feed was returning only the cbETH/ETH ratio with no ETH/USD multiplication applied. The codebase had tests, but none of them asserted that a reported price had to fall within a sane range; nothing would have stopped a $1.12 quote for a $2,200 asset from deploying.

04Testing the "AI wrote bad code" narrative

Mikko Ohtamaa later ran his own check on the claim that Claude was principally at fault. He fed the same pull request back to Claude and asked it directly to identify which oracle address was wrong and why. His takeaway: "Regardless of whether the code is written by an AI or by a human, these kinds of errors are caught in an automated integration test suite... In this case, tests existed, but there was no test case for price sanity, not in the tests, not in the production itself." He added that a human deployer at Moonwell should also have run manual checks as part of the DAO's process, and that this step was skipped as well.

That distinction matters because misconfigured price feeds and missed sanity checks are old, familiar DeFi failure modes that don't require an AI in the loop at all. What AI does change, several commentators argued, is how convincing wrong code can look. Patrick Collins of Cyfrin put it bluntly: "AI is really good at convincing you that your code is good. Remember, AI is like a really smart fast-working recently graduated post-grad, and is actually still kind of an idiot. And will lose you millions of dollars."

Pashov, who first surfaced the Claude co-authorship publicly, offered a more measured take afterward: "Of course, human behind AI decides and reviews the code, possibly a security auditor as well. Sad to see another exploit, but makes you wonder a bit about vibe-coding." SlowMist's Cos was more direct, calling the underlying error "a very low-level mistake" and adding, "One highlight of this vulnerability is: Co-Authored-By: Claude Opus 4.6. Claude's latest and strongest model."

05Tracing the money without a hacker to trace

Unlike most incidents this publication covers, there was no attacker wallet to follow, no exploit contract to decompile, and no Tornado Cash trail. Every dollar moved through Moonwell's own liquidation and borrowing mechanics, functioning exactly as coded, against a price that was simply false.

Anthias Labs' public accounting breaks the resulting bad debt down across eleven assets: cbETH ($1,033,393), WETH ($478,998), USDC ($232,584), EURC ($11,566), cbBTC ($11,442), cbXRP ($7,947), DAI ($1,520), USDS ($1,052), AERO ($204), MORPHO ($171), and wstETH ($164) — a total of $1,779,044.83. The spread across so many collateral types reflects borrowers with mixed portfolios having all of their positions dragged toward liquidation once cbETH, used widely as collateral, collapsed in reported value.

This is not the first time Moonwell has had to reckon with an oracle-driven debt hole. After an October 10 incident left the protocol with $1.7 million in bad debt, governance voted to cover the shortfall from protocol reserves. Forum users pointed back to that precedent almost immediately after the February incident, since the same question of who absorbs the loss was once again unresolved.

06A pattern, not an isolated bug

Yieldsandmore compiled Moonwell's recent oracle history and counted three separate failures in a bit over four months, totaling roughly $7.8 million in bad debt:

• October 10: oracle feeds mispriced three volatile tokens; an attacker used flash loans to drain positions at 85–88% LTV, generating $1.7 million in bad debt.
• November 4: the wrsETH oracle briefly reported 1 wrsETH as worth 1,649,934 ETH after a Balancer exploit had destabilized rsETH liquidity the day prior; the same attacker exploited it, adding $3.7 million in bad debt.
• February 15: the cbETH oracle's missing ETH/USD multiplication, introduced through AI-assisted code, added $1.78 million in bad debt.

Two of the three incidents share the identical root cause — a price feed missing its ETH/USD multiplier on a liquid staking token. Yieldsandmore's verdict on Moonwell, in full: "Do. Not. Use. It."

07The internet's verdict

Once Irboz and Pashov flagged the Claude co-authorship, "vibe coding" jokes spread well beyond crypto-security circles. WhiteHatMage summarized it tersely: "Moonwell forgot to add 'MAKE NO MISTAKES' to their security-whitehat agent." Pashov tried to steer the conversation toward practical takeaways: "First rule of using AI: make sure it is thinking critically and hallucinating as little as possible to you. Second rule of using AI: do pre-deployment rigorous audits with experienced whitehats." Patrick Collins added a third: "Third rule of AI: Give it your private key if you wish to peril."

08The unresolved question

No wallet needs to be sanctioned here and no multisig needs to explain itself — the code ran precisely as written, a governance vote approved it with 99.1% support, and the result was $1.78 million in unrecoverable debt. The failure sits across every layer that was supposed to catch it: Claude wrote code that compiled cleanly and handled the edge cases it was told to handle; Copilot's automated review passed it; human reviewers signed off; and Moonwell's DAO approved it by an overwhelming margin. Nobody in that chain checked whether the reported price made basic sense.

With three oracle incidents and roughly $7 million in bad debt accumulated over about four months, Moonwell now has a recurring problem that predates its use of AI-assisted development but was not caught by it either. The immediate question of whether affected users get made whole, as they were after October 10, remains open on Moonwell's governance forum. The larger one — who is accountable when an AI model, its human reviewers, an automated code-review bot, and a DAO vote all miss the same basic arithmetic error — has no settled answer yet.