Moonwell’s exploit has turned attention to a hard question for DeFi teams: how much trust can be placed in AI-written contract logic. On February 17, 2026, security experts linked the attack to code co-authored by Claude Opus 4.6, with losses estimated at about $1.78 million. The case is being discussed as one of the first prominent crypto incidents tied to “vibe-coding” and a major financial loss.
A pricing formula pushed cbETH from about $2,200 to $1.12
The reported failure centered on the protocol’s cbETH oracle pricing logic. Developers had used Anthropic’s latest AI model to help write smart contract code, but the generated formula introduced a basic math mistake. Instead of reflecting a real market value of roughly $2,200, the contract treated cbETH as worth only $1.12. That created a gap of about 99%, which attackers were able to exploit and drain from the lending protocol in short order.
GitHub records drew attention to AI’s role in the commit history
Smart contract auditor Pashov was among the first to flag the issue publicly. He said the project’s GitHub history showed commits marked “Co-Authored-By: Claude Opus 4.6”. That detail pushed the debate beyond a single bug and into development practice. In this style of rapid AI-assisted coding, code can look acceptable at a glance while still missing a low-level error in a core pricing function. That is what this incident exposed.
Human review failed to catch what was described as a basic error
SlowMist founder Cos described the exploit as a very basic mistake, one that should have been caught in human review before deployment. The source material also notes that Anthropic had recently said the model found 500+ bugs in other software. In this case, though, code generated with the model introduced a fresh vulnerability into an onchain lending system. For protocols holding user funds, speed in development does not remove the need for manual verification and formal auditing.
AI-assisted smart contract development now faces tighter scrutiny
The incident does not suggest AI will disappear from crypto development. It does show the limits of relying on it without close oversight. In Moonwell’s case, oracle logic, collateral pricing, and lending functions were too sensitive to leave unchecked. Based on the facts available here, the lesson is narrow but clear: if AI contributes to smart contract code, especially code tied to asset pricing, deployment still needs experienced human review and professional security auditing.