In February 2026, the decentralized lending protocol Moonwell became the first major security failure of the "vibe coding" era. The incident, which resulted in a net loss of $1.78 million, was not the work of a sophisticated hacker or a structural flaw in legacy code. Instead, it was a logic error in a smart contract co-authored by Anthropic's Claude Opus 4.6. [...] Rather than multiplying the cbETH/ETH exchange rate by the ETH/USD price feed, the AI-generated code used the raw exchange ratio as if it were already denominated in dollars. [...] The cbETH token, which was trading at approximately $2,200, was suddenly valued by the oracle at just $1.12.
One missing multiplication. The contract took a ratio and treated it as a dollar figure, so an asset worth about 2,200 dollars was priced at 1.12, and liquidation bots did what liquidation bots do: within four minutes they had seized 1,096 cbETH for pennies. The code went in through governance proposal MIP-X43 to integrate Chainlink's OEV wrappers, and a security researcher traced the pull requests to commits co-authored by Claude Opus 4.6. It is the clearest financial number on this page attached to generated code, and the reason it is here rather than in a crypto column is the shape of the bug: not a vulnerability anybody could scan for, but a unit error that reads perfectly and is wrong. Moonwell had lost money to oracle problems twice before without any AI involved, which is the honest caveat: the assistant supplied the error, and the system that let one line of arithmetic reach production unchecked was already there.
