The $1,808 Governance Heist: How an Attacker Nearly Drained $1M From Moonwell

On March 25, 2026, an attacker spent exactly $1,808 — the price of a decent laptop — to buy 40 million MFAM governance tokens on SolarBeam DEX. Within hours, they'd submitted a malicious governance proposal that, if executed, would have given them full administrative control over Moonwell's seven lending markets and the ability to drain over $1 million in user funds. The proposal title? "MIP-R39: Protocol Recovery – Managerial Transfer." It sounded helpful. It was anything but. This attack didn't exploit a smart contract bug. It didn't require flash loans, oracle manipulation, or zero-day vulnerabilities. It exploited something far more fundamental: the governance mechanism itself . Let's dissect how it worked, why it almost succeeded, and what every DeFi protocol with on-chain governance needs to learn from it. The Attack: Anatomy of a $1,808 Coup Step 1: Acquire Voting Power on the Cheap The attacker identified that MFAM — Moonwell's legacy governance token on Moonbeam — had extremel