Is Moonwell Safe?
Risk Grade: C (46/100)
Moonwell is rated as elevated risk — multiple novel mechanisms and notable interaction risks.
High risk — four exploits in three years and a removed bug bounty program suggest systemic security weaknesses
A lending protocol on Base and Optimism where you deposit crypto to earn interest or borrow against it, managing $500M in deposits. It has been hacked four times in three years, including a $1M exploit in November 2025 caused by a faulty price feed. Its C- grade reflects this pattern of repeated security failures.
TVL
$48M
Mechanisms
7
Interactions
6
Value Grade
D+
Key Risks for Moonwell Users
Hacked four times in three years. The November 2025 exploit used a faulty price feed that valued one token at $5.8M instead of $3,500. An attacker borrowed $1M against worthless collateral.
The bug bounty program was removed in February 2025. Within months, the protocol suffered $2.7M in additional exploits. Without bounties, security researchers have no incentive to report vulnerabilities.
During the October 2025 market crash, the protocol accumulated $1.7M in bad debt when prices dropped too fast for the system to sell-off risky positions in time.
Top Risk Factors
- •Four major exploits in three years including a $1M Chainlink oracle manipulation in November 2025 and $1.7M bad debt from October 2025 crash
- •Removed Immunefi bug bounty program in February 2025, eliminating white-hat financial incentives months before suffering $2.7M in exploits
- •Compound v2 fork inherits known liquidation fragility during correlated market downturns with cascading bad debt risk
How Moonwell Compares to Peers
Moonwell ranks #78 of 90 Lending protocols (bottom quartile — among the riskiest). At a risk score of 46/100, it's 9 points riskier than the sector average of 37/100.
Adjacent peers: Ion Protocol (C, 45/100) is ranked just safer, and Nostra Finance (C, 46/100) is ranked just riskier.
See the full Lending sector leaderboard or the Moonwell vs Nostra Finance comparison.
Common Questions about Moonwell
Plain-English answers based on Moonwell's scores across Hindenrank's 8 risk dimensions. The highest-scoring (riskiest) dimension is Track Record (12/15).
Has Moonwell ever been hacked or exploited?
Moonwell has a documented incident history that materially raised its risk grade — the track record dimension scored 12/15, near the high end of the scale. Past exploits, governance failures, or contract issues are baked into this rating. Anyone considering deposits should review the incident details before allocating capital.
How much money is at stake in Moonwell?
Moonwell currently holds roughly $48M in user deposits. Smaller TVL means individual depositors carry a larger share of any loss event, and it can be harder to exit a position quickly during stress.
What's the worst-case scenario for Moonwell?
Hindenrank has identified specific collapse scenarios for Moonwell. The most prominent: "Oracle Manipulation Cascade". The trigger condition is A Chainlink oracle price feed malfunctions or is manipulated, reporting grossly inflated collateral values for a supported asset. Reading through the full scenario list on the protocol page is the single best way to understand the actual failure modes — generic "smart contract risk" is rarely the thing that takes a protocol down.
Is Moonwell regulated or insured?
Moonwell has low regulatory exposure on Hindenrank's framework (3/10). The protocol is structured in a way that minimizes counterparty and jurisdiction concentration, though regulatory risk in crypto can change rapidly. No DeFi protocol carries FDIC-style insurance — even with low regulatory risk, depositors are not protected in the way bank customers are.
What are the biggest red flags for Moonwell?
Hindenrank's retail-focused risk audit flagged: Hacked four times in three years. The November 2025 exploit used a faulty price feed that valued one token at $5.8M instead of $3,500. An attacker borrowed $1M against worthless collateral. The bug bounty program was removed in February 2025. Within months, the protocol suffered $2.7M in additional exploits. Without bounties, security researchers have no incentive to report vulnerabilities. During the October 2025 market crash, the protocol accumulated $1.7M in bad debt when prices dropped too fast for the system to sell-off risky positions in time. On the technical side, 2 critical-severity interaction risks have been identified.
Should beginners deposit into Moonwell?
Moonwell's C grade puts it in the elevated-risk band. This is not a beginner-friendly protocol. Anyone depositing here should treat the position as speculative and avoid concentrating significant savings in it.
How does Moonwell compare to safer Lending alternatives?
Moonwell is one protocol in Hindenrank's Lending coverage. The safest Lending protocols on the leaderboard tend to share three traits: a long incident-free track record, conservative mechanism design, and high-quality public documentation. Compare Moonwell against the full Lending ranking before committing capital.
For the full 8-dimension score breakdown, the radar chart, and dependency graph, see the Moonwell risk report.
Read the Full Moonwell Risk Report
This protocol has 3 collapse scenarios. 2 critical and 3 high-severity interaction risks identified. See the full mechanism classification, interaction matrix, and deep-dive recommendations.
View Full Report →Get risk alerts before it's too late
Weekly grade changes, downgrade alerts, and new protocol risk findings. Free.