Ethereum DeFi platform Makina Finance lost 1,299 ETH worth approximately $4.1 million on January 20 after hackers manipulated price oracles on its DUSD-USDC liquidity pool hosted on Curve Finance.
An MEV builder frontran the attack and captured the majority of stolen funds, complicating recovery efforts for the yield management protocol that launched in February 2025.
Blockchain security firm PeckShield first detected the exploit at 03:40:35 UTC, with the attacker converting stolen tokens into ETH across two wallets that currently hold the assets.
What Happened
The attacker borrowed a flash loan of 280 million USDC, using 170 million to manipulate the MachineShareOracle that determines prices for the Dialectic USD and Dialectic USDC stablecoin pool.
After artificially inflating pool prices, the attacker traded 110 million USDC against the manipulated pool to drain 1,299 ETH before repaying the flash loan.
PeckShield confirmed the attack exploited a price manipulation vulnerability, with the perpetrator adding liquidity immediately before inflating prices and withdrawing with profits.
However, an MEV builder address starting with 0xa6c2 frontran the transaction that drained the pool, capturing approximately $4.14 million of the stolen funds.
Read also: Japan Bond Yields Hit Multi-Decade Highs, Threatening Global Crypto Liquidity
Current Status
The stolen ETH currently sits in two Ethereum addresses: wallet 0xbed2...dE25 holding $3.3 million and wallet 0x573d...910e containing $880,000.
Makina activated security mode on all its smart vaults and advised DUSD Curve pool liquidity providers to withdraw remaining funds.
The platform confirmed the exploit affected only DUSD liquidity provider positions on Curve, with other assets and deployments remaining unaffected.
Security firms including PeckShield, ExVul, and TenArmor urged users to revoke smart contract permissions and avoid interacting with Makina contracts pending investigation.
DeFi Security Context
Flash loan exploits remain common despite improved security, with decentralized exchange Bunni losing $8.4 million in October 2025 and Shibarium suffering a $2.4 million attack in September.
However, Chainalysis data show DeFi hack losses remained suppressed throughout 2025 even as total value locked reached $119 billion, representing a departure from historical patterns where capital influxes correlated with increased attacks.
Total cryptocurrency theft reached $3.4 billion in 2025, but the attack focus shifted toward centralized exchanges and personal wallets rather than DeFi protocols.
Read next: Russian Lawmakers Propose Harsh Mining Penalties: Individuals Face $1,500 Fines, Companies $100K+