Hack history / 2026 / Hack or exploit
MakerDAO ETH-A Liquidation Keeper Bot
Hack or exploit on Oct 6, 2026 · Improper Access Control
SOURCES AGREE ON DATE AND LOSS · 2 SOURCES
Lost
$538K
dollars at the time
Returned
none listed
as the sources state it
Rank
#1,122
among thefts by dollars lost
What happened
A dormant third-party MakerDAO ETH-A liquidation keeper had an unprotected drain routine that lacked ds-auth authorization. Any caller could invoke the function and provide the withdrawal recipient. The attacker triggered Flipper.deal() for four auctions the keeper had won in 2020, causing 200 WETH of previously unclaimed collateral to move through Vat.flux to the keeper, then used GemJoin.exit() to send it to an attacker-controlled recipient and unwrap it to ETH. MakerDAO’s core contracts behaved as designed; the vulnerability was in the third-party keeper
Details
- Date
- Oct 6, 2026
- Kind
- Hack or exploit
- Method
- Improper Access Control
- How in
- Smart contract bug
- Target
- DeFi protocol
- Chains
- Ethereum
Reported by
Related incidents
Zero Edge crypto casino enters liquidation after founder gambles away its seed money 2025 · Collapse or insolvency · $8.3M
Harvest Keeper 2023 · Hack or exploit · $933K
Blockchain Global enters liquidation 2021 · Collapse or insolvency · $50M
MakerDAO 2020 · Hack or exploit · $8.3M
SUPERFORTUNE AI 2026 · Hack or exploit · $15.2M
Harvest Keeper 2023 · Hack or exploit · $933K
Blockchain Global enters liquidation 2021 · Collapse or insolvency · $50M
MakerDAO 2020 · Hack or exploit · $8.3M
SUPERFORTUNE AI 2026 · Hack or exploit · $15.2M
Cite this page
SwanBluechip, "MakerDAO ETH-A Liquidation Keeper Bot hack, Oct 6, 2026: $538K lost", Crypto hack history, https://swan-hack-tracker.pages.dev/history/i/htd40203a5ea/ (data as of 2026-11-01).