Hacker Stole Over Half Million Dollars from MakerDAO through Vulnerability in 2020 Contract

Published: October 7, 2026 – 18:29 UTC

The attacker withdrew 200 ETH from a MakerDAO legacy contract on Ethereum.
The vulnerability allowed him to gain full control over the contract’s account in MakerDAO Vat.
The stolen funds started flowing into Tornado Cash just six minutes after the attack.

October 6, 2026, an unknown attacker exploited a vulnerability in a legacy MakerDAO contract on Ethereum and stole 200 ETH worth about $543,000.

#CertiKInsight On 6 Oct, a MakerDAO liquidation keeper bot was exploited resulting in a loss of 200 ETH (~$542k).Read our full analysis here https://t.co/Tak24xRZYsFind all our stats on our CertiK Security Report Dashboard https://t.co/0s5Uv84lqY
— CertiK Alert (@CertiKAlert) October 7, 2026

The attack was carried out via a legacy auction keeper that held collateral from MakerDAO liquidations in March 2020, known as “Black Thursday.” The exploit was made possible by missing access control on one of the contract’s functions.

How the Attack Happened

According to the incident analysis, the hacker first funded an address with 0.1 ETH via Tornado Cash, and at 06:12 UTC deployed a custom contract for the attack. A minute later, he sent a transaction that enabled access to the assets held by the old keeper contract.

The key issue was the 0x8804d1de function in the contract implementation. Unlike other privileged functions, it did not check access rights and allowed delegation to an arbitrary address via MakerDAO Vat.

The exploit flow consisted of several stages:

The hacker created an adapter module and passed its address into the keeper’s vulnerable function
The contract granted this module full control over the keeper’s account in Vat via Vat.hope()
After that, the keeper called the module’s join() function, handing code execution over to the attacker
The attacker settled four old auctions — No. 1457, 1458, 1459, and 1460
Each of them contained a 50 ETH lot that the keeper had won with a zero bid back in March 2020, but never paid for
After the auctions ended, 200 ETH were credited to the keeper account in Vat, from where the attacker withdrew them via the obtained delegation

As a result, it was the unfinished positions from the 2020 liquidations that made the old vulnerability economically viable.

Funds Started Being Mixed After Six Minutes

The full 200 ETH reached the attacker in a single exploit transaction one minute after the attack. Just six minutes later, he made the first transfer to Tornado Cash.

Overall, the attacker began splitting the stolen funds into 10 ETH deposits. Transaction analysis shows that a Tornado Cash router was used for this.

The main cause of the incident was the lack of access control checks for function 0x8804d1de. In addition, after granting the delegation, the contract did not call nope, so the delegated permissions remained active after the operation was completed.

Recall that in 2023, an unknown arbitrage bot used the MakerDAO DssFlash contract to take out a $200 million flash loan in DAI, but after fees earned only $3.24. In 2024, the Curio protocol, linked to the MakerDAO ecosystem, suffered another attack due to a smart contract vulnerability: the attacker minted 1 billion CGT, and the losses were later estimated at $16 million.

Сообщение Hacker Stole Over Half Million Dollars from MakerDAO through Vulnerability in 2020 Contract появились сначала на INCRYPTED.

Source: Incrypted