How much was lost in the Moola Market hack?

$8.4M Price Manipulation, as publicly reported (October 18, 2022).

Who was behind the Moola Market hack?

Publicly attributed to Whitehat-turned (funds returned). ChainHint does not attribute the attacker independently — it traces the funds from the address on the public record and reports where they went.

Case Studies/Moola Market

Moola Market Hack: $8.4M Price Manipulation

Q: How was the Moola Market hack carried out?

Price Pump & Over-Borrow. Aggressive spot buying of the thinly-traded MOO token inflated its price several-fold. The attacker posted the pumped MOO as collateral and borrowed CELO, cUSD, cEUR and MOO against phantom value, draining $8.4M from lending pools.

October 18, 2022 · Celo · Whitehat-turned (funds returned)

stolen

$8.4M

returned

93%

What happened

On October 18, 2022, Moola Market — a lending protocol on Celo — lost $8.4M to a price manipulation attack on its own MOO governance token. The attacker exploited MOO's thin on-chain liquidity: aggressive spot buying pumped the token's price several-fold, inflating the value of MOO posted as collateral, which was then used to borrow CELO, cUSD, cEUR and additional MOO far beyond the collateral's real worth. Moola paused the protocol as the funds began to move. Hours later, following public negotiation, the attacker returned roughly 93% of the stolen assets and kept the remainder as a de facto bug bounty — converting one of Celo's largest exploits into a mostly-recovered incident. ChainHint holds no fund-flow trace of its own for this incident.

How the funds moved

Step 1

Price Pump & Over-Borrow

Aggressive spot buying of the thinly-traded MOO token inflated its price several-fold. The attacker posted the pumped MOO as collateral and borrowed CELO, cUSD, cEUR and MOO against phantom value, draining $8.4M from lending pools.

Step 2

Dispersal Begins

Funds began moving off Celo — bridges, exchange deposits and mixer routes were all reported as destinations — before negotiations changed the trajectory.

Step 3

The 93% Return

Within hours the attacker returned roughly 93% of the loot to the protocol, keeping the remainder as a self-assigned bounty.

Key findings

Source Wallet

Moola ExploiterExecuted the MOO price pump and received all borrowed assets. ChainHint holds no address for it: the incident row carries none.

ExploiterFunds Returned

Attack Mechanism

Collateral price manipulation via thin liquidityNo smart contract bug — a pure economic exploit. Pumping the illiquid MOO token inflated on-protocol collateral value, enabling massively over-collateralized borrowing.

Price Manipulation

Recovery

~93% returned as negotiated bountyAfter public negotiation, the attacker sent back roughly 93% of the stolen assets and retained the rest — one of the highest voluntary return rates of 2022.

Whitehat-turned

Investigate your own incident

ChainHint traced the Moola Market hack in minutes.
Use the same tool for your case.