{"id":94395,"date":"2026-02-18T10:34:03","date_gmt":"2026-02-18T07:34:03","guid":{"rendered":"https:\/\/forklog.com\/en\/?p=94395"},"modified":"2026-02-19T10:40:29","modified_gmt":"2026-02-19T07:40:29","slug":"vibe-coding-via-claude-opus-leads-to-moonwell-defi-project-breach","status":"publish","type":"post","link":"https:\/\/forklog.com\/en\/vibe-coding-via-claude-opus-leads-to-moonwell-defi-project-breach\/","title":{"rendered":"Vibe Coding via Claude Opus Leads to Moonwell DeFi Project Breach"},"content":{"rendered":"<p>The lending protocol Moonwell <a href=\"https:\/\/forum.moonwell.fi\/t\/mip-x43-cbeth-oracle-incident-summary\/2068\">lost<\/a> $1.78 million due to an oracle configuration error. Smart contract auditor Pashov linked the incident to <span data-descr=\"a modern software development method where a person describes the desired outcome in plain language, and 90-100% of the code is generated by AI agents\" class=\"old_tooltip\">vibe coding<\/span> through Claude Opus 4.6.<\/p>\n<p>The failure occurred on February 15 following the activation of the Moonwell <a href=\"https:\/\/forklog.com\/en\/news\/what-is-a-dao-decentralised-autonomous-organisation\">DAO<\/a> proposal \u2014 MIP-X43. It allowed contracts using <a href=\"https:\/\/forklog.com\/en\/news\/what-is-chainlink-link\">Chainlink<\/a> OEV on the <a href=\"https:\/\/forklog.com\/en\/news\/what-is-base-coinbases-l2\">Base<\/a> and <a href=\"https:\/\/forklog.com\/en\/news\/what-is-optimism-op\">Optimism<\/a> markets.<\/p>\n<h2 class=\"wp-block-heading\">Technical Error<\/h2>\n<p>One of the oracles was incorrectly configured. It inaccurately determined the dollar price of Coinbase Wrapped ETH.<\/p>\n<p>Instead of multiplying the cbETH\/ETH rate by the ETH\/USD price, the system only transmitted the token ratio. As a result, the oracle showed a cbETH price of about $1.12 instead of ~$2200.<\/p>\n<h2 class=\"wp-block-heading\">Consequences for Users<\/h2>\n<p>Abnormally low quotes triggered a wave of liquidations. Trading bots attacked positions collateralized in cbETH. They repaid approximately $1 of debt and received 1096.317 cbETH in return.<\/p>\n<p>This wiped out most or all of the cbETH collateral for many borrowers, leaving a significant debt on their positions. Simultaneously, some users provided minimal collateral to borrow cbETH at the reduced price.<\/p>\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p>\u201cAs soon as the problem was discovered, our risk manager @anthiasxyz promptly reduced the cbETH borrowing limit to 0.01 to limit further risks to the protocol,\u201d Moonwell representatives wrote.<\/p>\n<\/blockquote>\n<h2 class=\"wp-block-heading\">Is Vibe Coding to Blame?<\/h2>\n<p>Smart contract auditor Pashov noted that <span data-descr=\"a method of saving changes in code\" class=\"old_tooltip\">commits<\/span> for Moonwell were co-authored with Claude Opus 4.6.<\/p>\n<blockquote class=\"twitter-tweet\">\n<p lang=\"en\" dir=\"ltr\">\ud83d\udea8Claude Opus 4.6 wrote vulnerable code, leading to a smart contract exploit with $1.78M loss<\/p>\n<p>cbETH asset&#8217;s price was set to $1.12 instead of ~$2,200. The PRs of the project show commits were co-authored by Claude \u2014 Is this the first hack of vibe-coded Solidity code? <a href=\"https:\/\/t.co\/4p78ZZvd67\">pic.twitter.com\/4p78ZZvd67<\/a><\/p>\n<p>\u2014 pashov (@pashov) <a href=\"https:\/\/twitter.com\/pashov\/status\/2023872510077616223?ref_src=twsrc%5Etfw\">February 17, 2026<\/a><\/p><\/blockquote>\n<p> <script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p>\u201cClaude Opus 4.6 wrote vulnerable code, leading to a smart contract exploit with a $1.78 million loss. [\u2026] Is this the first hack of vibe-coded Solidity code?\u201d he noted.<\/p>\n<\/blockquote>\n<p>The expert added that behind the AI is a person who checks the finished work, and possibly a security auditor. For this reason, blaming the neural network alone is incorrect, although the incident \u201craises questions\u201d about vibe coding.<\/p>\n<p>This approach to programming is becoming increasingly widespread, despite growing criticism from experts.<\/p>\n<p>In February, a study <a href=\"https:\/\/forklog.com\/en\/news\/security-flaw-discovered-in-ai-agent-social-network-moltbook\">identified<\/a> 69 vulnerabilities in 15 applications created using popular tools like Cursor, Claude Code, Codex, Replit, and Devin.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Moonwell lost $1.78 million due to an oracle configuration error. Smart contract auditor Pashov linked the incident to vibe coding through Claude Opus 4.6.<\/p>\n","protected":false},"author":1,"featured_media":94396,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"select":"1","news_style_id":"1","cryptorium_level":"","_short_excerpt_text":"Moonwell lost $1.78 million due to an oracle error linked to vibe coding.","creation_source":"","_metatest_mainpost_news_update":false,"footnotes":""},"categories":[3],"tags":[438,1301,2425],"class_list":["post-94395","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news-and-analysis","tag-artificial-intelligence","tag-blockchain-vulnerabilities","tag-vibe-coding"],"aioseo_notices":[],"amp_enabled":true,"views":"1439","promo_type":"1","layout_type":"1","short_excerpt":"Moonwell lost $1.78 million due to an oracle error linked to vibe coding.","is_update":"","_links":{"self":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/94395","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/comments?post=94395"}],"version-history":[{"count":1,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/94395\/revisions"}],"predecessor-version":[{"id":94397,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/94395\/revisions\/94397"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/media\/94396"}],"wp:attachment":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/media?parent=94395"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/categories?post=94395"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/tags?post=94395"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}