Incident Overview
On January 20, 2026, Makina Finance suffered a $5 million exploit through oracle manipulation when an attacker used a 280 million USDC flash loan to manipulate MachineShareOracle price data, draining the DUSD/USDC Curve pool, with the majority ($4.14M) frontrun and captured by an MEV builder.
The attacker obtained a flash loan of 280 million USDC and used it to artificially manipulate price data in the MachineShareOracle, which the Makina Finance protocol relied upon for accurate pricing. By distorting the oracle's price feed, the attacker created a discrepancy that allowed them to drain the DUSD/USDC stablecoin pool on Curve Finance. However, an MEV (Maximal Extractable Value) builder detected the exploit transaction in the mempool and frontran the attacker, intercepting approximately $4.14 million of the stolen funds before they reached the attacker's addresses.
The remaining stolen assets, totaling approximately $880,000 to $3.3 million, were distributed to the attacker's wallets. CertiK detected the exploit and flagged the suspicious activity, prompting Makina Finance to activate security mode across all Machines as a precautionary measure. The team confirmed the issue was isolated to DUSD liquidity provider positions on Curve, with underlying assets held in Machines remaining unaffected, and strongly advised LPs in the DUSD Curve pool to withdraw their liquidity immediately.
Incident Report
Protocol Information
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to Makina, these are the critical security checks that could have prevented this incident (January 2026).
- Verify all logic paths related to Flashloan Price Oracle Attack / Flash Loan Attack are guarded by proper access controls and input validation - see the Flash Loans Attacks attack class for patterns
- Audit oracle price feeds for manipulation risks - ensure time-weighted average prices (TWAPs) or multi-source aggregators are used, not spot prices
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialFunds Recovery
Recovered
$2.7M
Net Loss
2300000
Security Audit History
- Audit Report 1 Report
Related Attack Classes
The technique used in this hack maps to these vulnerability classes in our security curriculum:
Proof-of-Concept Exploits
On-Chain Evidence & References
- Twitter/X Alert https://x.com/nn0b0dyyy/status/2013472538832314630
- Twitter/X Alert https://x.com/TenArmorAlert/status/2013460083078836342
- Twitter/X Alert https://x.com/CertiKAlert/status/2013473512116363734
Sources & References
Learn to Prevent the Next Makina
The Makina hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.