If you supplied cbBTC to Moonwell's Base Core market before late August, your wallet may still show the full balance. Getting it out is another matter.

On 3 November, a supplier posting as Recover_Rowell filed a formal governance request on Moonwell's forum. It says there is "still no published remediation path for cbBTC suppliers" after the 27 August MAMO market incident. That's nearly ten weeks without a plan. According to the request, the market now holds "effectively zero withdrawable cbBTC."

How the MAMO Exploit Left cbBTC Suppliers Holding Bad Debt

Moonwell is a lending protocol, and its markets work as pools. Suppliers deposit a token and earn interest. Borrowers take that token out against collateral. You can withdraw only what is sitting in the pool as cash, not what is out on loan.

According to Moonwell's post-mortem, an attacker on 27 August combined collateral-accounting inflation with manipulation of MAMO's oracle price. The inflated collateral let them borrow across several markets, including 71.36 cbBTC. Liquidations repaid 17.76 cbBTC, which left 53.60 cbBTC of residual debt in the cbBTC market. Across all markets, the post-mortem estimated about $9.131 million of residual and potential bad debt, including about 2.345 million USDC.

The attacker then bridged 8,729,454 USDC from Base to Ethereum through Circle's CCTP and converted it to DAI. Moonwell's monthly governance report says contributors are working with law enforcement and security firm zeroShadow to recover the funds, which remain on Ethereum mainnet.

The Numbers Behind an Empty Pool

Risk manager Anthias Labs has tracked the damage. In its 29 September recommendations, it found:

  • 54.33 cbBTC ($4.52 million) of borrows sat in 8 insolvent accounts, where debt exceeds all collateral
  • only 3.79 cbBTC was borrowed across 93 healthy accounts
  • 93.5% of cbBTC debt was insolvent
  • supplier balances were only about 22% backed by cash and healthy loans
  • available cash fell 48%, from 23.09 cbBTC on 15 September to 11.92 cbBTC on 29 September

Anthias also counted $14.91 million of net shortfall across 111 accounts on Base as of 29 September.

Its weekly update for 23 to 29 October shows the squeeze getting tighter. cbBTC supply fell 8%, from 63.86 to 58.67 cbBTC, and utilization, the share of supplied tokens currently lent out, reached 100%. Gross bad-debt exposure stood at 54.87 cbBTC ($4,293,560.82), against reserves of 0.162 cbBTC ($12,612.05).

The supplier who filed the request claims about 1.462 cbBTC across three wallets, all funded before the incident. That's roughly 2.5% of the market's late-October supply. The addresses were offered privately for verification and weren't published, so the claim can't be checked independently.

Why a Small Repayment Doesn't Reach Most Suppliers

Here's the design detail that makes this painful. When anyone repays debt into a market at 100% utilization, that cash becomes withdrawable to whoever asks first. The request says each small repayment "is redeemed within hours by automated withdrawals."

The USDC market already showed how fast that happens. MIP-X66, which passed with about 98.5% support, repaid about $247,000 of protocol reserves into the Base USDC Core market. A USDC supplier reported that the liquidity "was consumed within seconds," giving automated users an edge over people withdrawing by hand.

So the cbBTC request asks for any funds sent to the market to be shared out pro rata, through a claim contract or a withdrawal queue. That way a supplier with a bot and a supplier with a phone get the same share.

What Governance Has Changed, and What It Hasn't

Moonwell's fixes so far target the size of the hole, not who gets paid. MIP-X66 cut projected interest accrual on bad debt from about $338,800 to about $50,300 a month. Anthias recommended a flat 1% borrow rate for cbBTC and raising its reserve factor, the share of interest kept by the protocol, from 10% to 99%.

The request says MIP-X66 and a later proposal, MIP-X69, reduced interest accrual on bad debt, but "none of them addresses repaying suppliers." It asks for three things:

  1. A published remediation plan for Base cbBTC suppliers, with a timeline
  2. A status update on zeroShadow's recovery effort
  3. Confirmation of whether the Moonwell Foundation treasury will be used

cbBTC isn't the only stuck market. A separate forum thread asks for a remediation path for cbETH suppliers who were never liquidated but still can't withdraw.

Some Suppliers May Not Know They're Stuck

The request's sharpest warning is about the interface. Wallets "continue to display these positions at full value," it says, so many cbBTC suppliers may not realise their exposure.

That gap between the number on screen and the cash in the pool is what the request wants governance to close. Whether the answer comes from recovered funds, the treasury or a queue for whatever trickles back in, the forum thread is where it will show up first.