Stale oracle parameters trigger DeFi losses without hacks in Aave and Moonwell incidents
On March 10, 2026, Aave misconfigured its CAPO risk oracle, capping the onchain wstETH exchange rate about 2.85% below market and triggering roughly 10,938 wstETH liquidations. Liquidation volume totaled about $26–27 million, with liquidators capturing around 499–512 ETH in value. On February 15, 2026, Moonwell misconfigured a Chainlink OEV wrapper after a governance change, reporting cbETH at about $1.12 instead of roughly $2,200 and enabling the seizure of 1,096.317 cbETH. The incident left the protocol with about $1.78 million in bad debt.