Moonwell restricted new borrowing across its Base Core Markets after security firms estimated an attacker used manipulated MAMO collateral to remove about $8.7 million in assets.