Moonwell, a decentralized lending protocol, is under a governance attack after an unidentified attacker spent $1,800 to acquire 40 million MFAM tokens. The attacker submitted a malicious proposal to transfer control of the protocol's core contracts to a contract they control, potentially putting $1.08 million in user funds at risk. The entire process, from token purchase to proposal submission and quorum achievement, took just 11 minutes. The proposal impacts seven lending markets, the comptroller, and the oracle, allowing the attacker's contract to withdraw protocol funds if enacted. Voting on the proposal continues until March 27. Although the proposal initially reached quorum quickly, most voters now oppose it. The final decision will depend on the complete vote tally and any undisclosed voting power.