Mentioned in This Article
1. What is happening in Moonwell's Base cbBTC market?
A supplier in the Moonwell lending protocol's Base cbBTC Core market filed a formal governance request on November 3 asking for a remediation plan with a timeline. The request, directed to Moonwell's contributors and its risk provider, Anthias Labs, arrives almost ten weeks after the August 27 MAMO exploit left the market with bad debt. An onchain reading of the market contract shows that almost nothing remains for suppliers to withdraw: about $1.72 of cbBTC in cash, against roughly $4.56 million in outstanding loans.
Moonwell is a decentralized lending protocol in which users deposit assets to earn interest and others borrow against collateral. Coinbase Wrapped Bitcoin (cbBTC) is a token that represents Bitcoin on the Base network. When a market works normally, suppliers can withdraw their deposits whenever the market holds enough unlent cash. Here, the cash is nearly gone, so suppliers are effectively locked in.
As of about 20:55 UTC on November 3, the forum thread carrying the request had received no replies.
2. How much cbBTC can suppliers actually withdraw?
A reading of the market contract on Base at block 53,474,710, taken at 20:46 UTC on November 3, showed about 0.0000221 cbBTC in cash. At a price of $77,683 per coin, that is roughly $1.72. This cash is all that suppliers can pull out of the market at present.
The same reading showed about 58.65 cbBTC, worth roughly $4.56 million, lent out. Suppliers had deposited about 58.48 cbBTC, and the contract held about 0.17 cbBTC in reserves. Because the loans outstanding exceed the amount supplied, the market cannot return deposits in full. The shortfall reflects loans that are unlikely to be repaid.
Anthias Labs counts most of those loans as bad debt. Its weekly update for October 9 to 15 put gross bad debt at 54.8 cbBTC against reserves of 0.1364 cbBTC, and its update for October 23 to 29 showed 54.87 cbBTC. In recommendations dated September 29, Anthias said 93.5% of the market's debt sat in insolvent accounts, and it described the market as one in which supplier balances were only about 22% backed by cash and healthy loans.
Bad debt means borrowing positions whose collateral is worth less than what they owe, leaving no practical way for the protocol to collect. When enough of a market's loans fall into that category, the people who supplied the assets bear the loss unless the protocol, its treasury or recovered funds cover the gap.
3. What did Moonwell do after the exploit?
Moonwell has taken several steps through its governance process. An improvement proposal known as MIP-X66, executed in early September, lowered projected interest on bad debt and repaid about $247,000 of protocol-owned reserves into the Base USDC Core market. A post-mortem listed that market as carrying about $2.35 million of residual attacker debt. The cbBTC market received no reserve repayment.
A second proposal, MIP-X69, took effect on Base on October 17, according to a reading of the market contract. It fixed cbBTC's borrow rate at 1% and set its reserve factor at 99%. A reserve factor is the share of borrower interest that the protocol keeps instead of paying to suppliers, so a 99% setting directs almost all interest into reserves. Both proposals are measures that slow the accrual of interest on bad debt.
The supplier's request points out that neither proposal addresses repaying suppliers. It also notes that, when liquidity reached the USDC market through the repayment, a USDC supplier wrote that users watching the market said the cash was consumed within seconds. That observation shows how quickly any new funds can be withdrawn when many depositors are waiting to exit.
4. What does the supplier want Moonwell to do?
The request asks for a remediation plan with a timeline and raises several specific questions. Will the Moonwell Foundation's treasury be used? How will any recoveries be divided among the affected markets? Do cbBTC suppliers rank alongside, or behind, the earlier remediation for the cbETH market? The author also asks for regular accounting of the cbBTC market's position.
On mechanics, the request asks that any money sent into the market be shared pro rata among current suppliers. It suggests that a claim contract or a withdrawal queue could handle the distribution, which would prevent the first people to act from taking everything and leaving others with nothing.
The author posts under a forum username and says they hold about 1.462 cbBTC across three wallets. They wrote that there is still no published remediation path for cbBTC suppliers and offered to share wallet addresses privately with contributors. Those holdings have not been verified.
5. Is there any recovery of the stolen funds?
A September governance report on Moonwell's forum says contributors are pursuing the stolen funds with law enforcement and with the security firm zeroShadow. None of the forum posts reviewed, however, gives a figure for how much has been recovered.
That absence matters for suppliers. Any plan to repay the cbBTC market depends on where the money would come from: recovered assets, the foundation's treasury, protocol reserves built from interest, or some combination. Until contributors state which sources they intend to use, suppliers have little basis for estimating how much of their deposits they might see again, or when.
Reserves provide limited help in this case. The contract holds only about 0.17 cbBTC in reserves, a tiny fraction of the roughly 54.87 cbBTC of gross bad debt Anthias reported for late October. Raising the reserve factor to 99% increases how fast reserves accumulate, but the market would need to generate far more interest to narrow the gap.
6. How do pooled lending markets handle a shortfall?
In a pooled lending market, suppliers do not lend to specific borrowers. Their deposits go into a common pool, and borrowers draw from it against collateral. Suppliers earn interest in return, and the protocol keeps a slice as reserves. The design allows instant deposits and withdrawals, but it depends on the pool holding enough unlent cash to meet requests.
When bad debt appears, the pool's assets are lower than the claims on it. The remaining cash is quickly withdrawn by the fastest users, leaving the rest holding claims on a pool with little cash. This is the situation described in the cbBTC market, where withdrawable cash has fallen to a tiny sum while loans remain outstanding.
Protocols generally have a few tools for such cases. They can use reserves, draw on a treasury, apply recovered funds, or spread losses among suppliers. Each option involves a judgment about who should bear the cost, and in a decentralized protocol those judgments usually go through governance proposals and community votes. That is why the supplier addressed the request to Moonwell's contributors and risk provider and framed it as a governance matter.
7. Why does this case matter for decentralized lending?
The situation illustrates a risk that lenders in decentralized finance accept, but that is easy to overlook when markets run smoothly. Deposits in a pooled lending market are only as safe as the loans made against them. When an exploit produces bad debt, the pool can lose the ability to honor withdrawals, and the way a protocol allocates the loss becomes a governance question rather than a technical one.
Different markets within the same protocol can also end up with different outcomes. Here, reserves went toward the USDC market, while cbBTC suppliers have been waiting for a plan. That divergence is part of why the supplier asks how recoveries will be divided and where cbBTC stands in the order of repayment.
For protocol contributors, the episode shows the cost of leaving a long gap between an exploit and a published remediation plan. Suppliers who cannot withdraw cannot reallocate their funds, and silence on a timeline leaves them guessing about what comes next.
The wider lesson concerns communication as much as code. Participants in decentralized finance generally accept technical risk, yet they also expect the teams behind a protocol to explain how losses will be handled. A published framework, even one that admits only partial repayment is possible, lets suppliers decide whether to wait, pursue other options or adjust their expectations. Without one, uncertainty can last as long as the exploit's aftermath itself.
Regular accounting, which the supplier also requests, would serve a similar purpose. A recurring statement showing cash, loans, reserves and bad debt for the cbBTC market would let depositors see whether conditions are improving without needing to read the contract directly. Risk providers already publish weekly updates, and extending that practice to remediation progress would give the community a clearer picture of where matters stand.
8. What happens next?
The next development to watch is whether Moonwell's contributors or Anthias Labs respond to the governance request. A reply could take the form of a formal proposal, a statement of what funds are available, or a timeline for a vote. No such response had appeared in the thread as of the evening of November 3.
Other indicators are visible onchain. Changes in the market's cash balance, in outstanding loans, or in the level of reserves would suggest that money is moving. Anthias's weekly risk updates should also show whether gross bad debt continues to hover near 54.87 cbBTC or begins to fall.
Until then, cbBTC suppliers in the Base Core market remain unable to withdraw nearly anything, and the gap between deposits and available cash stays close to the full size of the loan book.