Saturday, February 21, 2026

One math error. Four minutes of chaos. $1.78 million gone.

A single missing multiplication, cbETH/ETH without the ETH/USD, turned a $2,200 asset into a $1.12 one, and liquidation bots didn't wait for a second opinion. They never do.

By the time Moonwell's risk manager slashed the borrow cap, 1,096 cbETH had already been seized for roughly the price of a parking ticket per token.

Borrowers lost their collateral. The protocol was left with $1.78 million in bad debt.

The root cause was buried in the GitHub commit that started it all: The commit was co-authored by Claude Opus 4.6.

Three oracle failures in over 4 months. Roughly $7.8 million in bad debt accumulated when all added up.

Same protocol, same class of error, new victims. The formula is almost elegant in its repetition - trust the price feed, skip the sanity check, watch the bots feed.

But this time, something shifted. This wasn't just another DeFi postmortem about misconfigured oracles and insufficient testing.

This one came with a question that the industry isn't ready to answer yet.

When AI writes the code and humans approve it without understanding it, who exactly signed off?

Read more »

We provide an anonymous platform for whistleblowers and DeFi detectives to present their information to the community. All authors remain anonymous. 
We are all rekt.