A known white hat maximal extractable value (MEV) actor, operating under the pseudonym c0ffeebabe.eth, has once again intervened in a decentralized finance (DeFi) exploit—this time rescuing approximately $2.6 million in crypto assets stolen from Morpho Labs’ Morpho Blue protocol.
The incident stemmed from a front-end update by Morpho Labs on April 10. Within 24 hours, an attacker exploited a vulnerability introduced by the update, compromising a user’s address. Blockchain security firm PeckShield flagged the breach, confirming that $2.6 million had been siphoned.
However, before the attacker could fully capitalize on the exploit, c0ffeebabe.eth deployed an MEV bot to front-run the malicious transaction, effectively intercepting the stolen assets. At press time, the rescued funds had been moved to another wallet, but there was no official confirmation on whether they had been returned to the affected user.
In response, Morpho Labs swiftly rolled back the update and reassured users in an April 11 post on X:
“All funds in the Morpho Protocol are safe and unaffected. The Morpho team will provide a detailed update later today in this thread.”
Further investigations confirmed that the issue lay in how certain transactions were constructed through the front-end interface. The development team has since applied a fix and clarified that users are not required to take extra precautions.
Morpho Labs explained that the update was intended to improve transaction flow but inadvertently led to incorrect transaction formatting, opening a security gap. A full post-mortem is expected next week.
C0ffeebabe.eth has a strong track record of neutralizing DeFi threats. The anonymous operator previously recovered $5.4 million worth of Ether during the Curve Finance hack in July 2023 and intercepted stolen funds during the Blueberry protocol exploit in 2024—returning all assets to their rightful owners. The Blueberry attack resulted in the loss of around $1.3 million worth of Ethereum (ETH).
If you want to read more news articles like this, visit DeFi Planet and follow us on Twitter, LinkedIn, Facebook, Instagram, and CoinMarketCap Community.
“Take control of your crypto portfolio with MARKETS PRO, DeFi Planet’s suite of analytics tools.”
