DeFi Protocols Lose $129M in 48 Hours Amid Oracle Failures

How DeFi Protocols Lose $129M Amid Oracle and Access Control Flaws

Two major DeFi protocols lost $129 millions in 48 hours, marking one of the worst starts to a month in decentralized finance this year. Balancer and Moonwell experienced one disaster after another exposing important vulnerabilities within oracle infrastructure and access controls.

On 3 November, Balancer received a breach of 128 millions dollars and Moonwell was hit on 4 November by a loss of $1M. Collectively, the events point to ongoing weaknesses in multi-chain protocols and increasing the risks of using external infrastructure to provide price feeds and manage systems.

Source: X

Chainlink Oracle Glitch Triggers $1M Moonwell Exploit

Moonwell’s lending platform on Base suffered an exploit after a Chainlink oracle malfunction temporarily mispriced a token. The attacker deposited 0.02 wrstETH as collateral, but the oracle valued it at $5.8 million. This pricing error allowed the hacker to borrow over 20+ wstETH multiple times within a few hours.

Blockchain analytics firm CertiK confirmed the DeFi protocols lose $129 million  trend stemmed partly from such infrastructure dependencies. The attacker executed several rapid transactions within single blocks to avoid detection and liquidation, making a total profit of 295 ETH about $1.1M.

After the exploit, the Total Value Locked (TVL) in Altcoin declined by $55 million to 213 million, and its WELL token dropped over 12%. This is the fourth significant breach Moonwell had in three years, which highlights the frequent security concerns of its system.

Balancer Breach Deepens DeFi’s Security Crisis

In a multi-chain exploit of access control vulnerabilities, Balancer lost $128 million the day prior to Moonwell attacking. The attack involved Ethereum, Arbitrum, Base, Optimism, Polygon and Sonic. In reaction, Berachain suspended all its network to have an emergency hard fork.

As observed by security analysts, the problem in altcoin was a result of a bad oracle feed whereas the problem in Balancer was due to lack of permission controls. All of this added to the worry that DeFi protocols lose $129M to flimsy underlying systems and not single contract bugs.

Repeated Incidents Highlight Systemic Weaknesses

In early 2025, Moonwell faced renewed criticism after it decided to cancel its Immunefi bug bounty program. The absence of incentives to disclose ethically could have perpetuated vulnerabilities. Altcoin has incurred two significant losses amounting to $2.7 million in a span of less than a month.

The joint DeFi protocols loss $129M events in only 48hrs prove that failures in the infrastructure, oracle errors, and poor security practices still pose a threat to the stability of decentralized finance. The most advanced DeFi projects are vulnerable to being attacked based on the vulnerability of their systems at the system level.