Makina Hack

Reported loss $4.2M
Ethereum
Flashloan Price Oracle Attack

What happened

On 20 January 2026 Makina Finance, a DeFi execution engine on Ethereum, lost about 1,299 ETH (roughly $4.1 million) from its DUSD/USDC Curve pool through a flash-loan price manipulation. CertiK and The Block put the amount withdrawn from the pool at about $5 million. The attacker borrowed about 280 million USDC and used around 170 million of it to skew balances in a Curve pool that Makina's accounting read. An accounting instruction valued a position with Curve's calc_withdraw_one_coin(), so the skewed balances inflated the reported value. That inflated value flowed through Caliber and Machine AUM into MachineShareOracle, the price source for the DUSD/USDC pool, and the pool was drained at the wrong price.

The attack was itself front-run. An MEV searcher copied the attacker's transaction and executed it first, and almost all of the ETH went to the MEV builder, which passed about 276 ETH to a Rocket Pool block proposer. CertiK flagged the exploit. Makina put all Machines into security mode, said the problem was limited to DUSD LP positions on Curve, told those LPs to withdraw, and offered a 10% SafeHarbor bounty. The builder returned 920.7 ETH on 22 January, keeping a 10% bounty, and the Rocket Pool validator returned 157.1 ETH on 23 January. Makina refunded affected LPs in batches from 23 January, excluding addresses that profited from the pool dislocation. It then shipped a V1.1 that makes accounting updates permissioned, adds exchange-rate deviation limits and removes all Curve integrations from approved instructions. Makina said its audits had focused on the core system and assumed approved accounting instructions could not be manipulated.

Drain transaction: 0x569733b8016ef9418f0b6bde8c14224d9e759e79301499908ecbcd956a0651f5

How it happened

  1. The attacker took flash loans of about 280 million USDC (Rekt reports 160.6 million from Morpho and 119.4 million from Aave V2).
  2. About 170 million USDC went into a Curve pool to unbalance it, so calc_withdraw_one_coin() returned an inflated amount for the position that one of Makina's accounting instructions valued.
  3. The attacker triggered an AUM update. Rekt says updateTotalAum() was permissionless and read spot values with no delay, so the inflated position value passed through Caliber AUM and Machine AUM into MachineShareOracle within the same transaction.
  4. The DUSD/USDC Curve pool priced DUSD using that oracle, so trading and withdrawing against it at the inflated rate extracted about 1,299 ETH worth of value. The flash loans were repaid in the same transaction.
  5. An MEV searcher (0x935bfb495E33f74d2E9735DF1DA66acE442ede48) copied the attack and landed it first in block 24273362, and nearly all the proceeds went to the block builder. Most of the ETH was later returned to Makina for LP refunds.

Protocol details

Classification Protocol Logic / Yield Aggregator / Oracle Manipulation
Protocol Type Onchain Capital Allocator
Implementation language Solidity
Protocol links Website @makinafi

Funds Recovery

64.3%

Recovered

$2.7M

Net Loss

$1,499,400

Evidence

Proof of concept

1 available

Sources

Understand the attack patterns

Compare incidents →
Flash Loan Attacks Oracle Manipulation & Price Manipulation

Same attack technique

Browse all hacks →
Ethereum UwU Lend $3.7M lost Arbitrum Themis Protocol $370K lost Fantom DEUS Finance $17.9M lost BNB Chain Elephant Money $22.2M lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes