Moonwell was hit by a multi-million-dollar DeFi exploit after a pricing oracle bug pushed cbETH from its normal market level of nearly $2,200 down to an erroneous on-chain value of just $1.12. Security analyst Pashov, who brought attention to the incident, pointed to a sharp lesson for crypto developers: once AI-assisted code reaches production, even a basic mistake can become a live financial vulnerability.
The flaw came from a bad pricing formula
At the center of the breach was a math error embedded in Moonwell’s oracle logic. According to the report, the issue was not an obscure edge case but a flawed formula inside the smart contract’s price calculation flow. SlowMist founder Cos said that this miscalculation in the price feed disrupted the protocol’s balance and created an opening attackers could exploit almost immediately. One wrong value was enough to detach a major asset from market reality.
Review of Moonwell’s GitHub repository and pull requests pushed the discussion beyond the exploit itself and into the development process. The faulty code was described as co-authored by the Claude model and human developers, with Claude Opus 4.6 tied to the code in question. The report argues that heavy reliance on AI coding assistance, without strong manual review and security checks, turned a protocol handling billions in volume into an exposed target.
A costly warning for the “vibe-coding” era
Industry participants have described the episode as the first major hack of the “vibe-coding” era. The push for faster shipping meant giving large development authority to generative models while cutting back on rigorous review. That decision did more than produce losses on-chain. It also raised doubts about whether emerging code-generation systems are reliable enough for financial infrastructure where every calculation matters.
Pashov and Cos both warned that autonomous systems can introduce mathematical mistakes that are small in appearance and severe in effect. A misplaced decimal or a wrong multiplier inside a pricing path can erase millions of dollars within seconds. In DeFi, that risk is especially acute in modules tied to oracles, collateral values and liquidation logic.
Human review remains the hard requirement
The response from the security community has been clear: generative AI cannot be left to carry responsibility for high-stakes financial code on its own. No matter how capable the models become, the report says professional auditors and hands-on developer review remain the strongest safeguard. The Moonwell breach is now being cited as one of the clearest examples of AI “hallucination” during development producing direct and expensive financial consequences.