On March 7, 2026, Molt EVM on Base was exploited for ~$127K via missing access control on the setSpawnerToken() function. The attacker overwrote the authorized spawner with their own contract, then called the protected spawnTokens() function to mint 100 million mEVM tokens at zero cost and swapped them for WETH.

Molt EVM, an experimental self-replicating ERC-20 token protocol on Base, was exploited due to a weak access control flaw. The attacker deployed a malicious contract to bypass the onlySpawnerToken modifier, minted large amounts of tokens via mintFromSpawner(), and dumped them through liquidity pools for profit.