Automated DeFi Platform Makina Finance Hit by Flash Loan Exploit, 1,299 ETH Taken from Curve Pool

Makina Finance $4.13 Million Drain Hits Stablecoin Pool

The institutional-grade DeFi execution engine, Makina Finance, became the latest victim of a sophisticated on-chain heist early Tuesday morning.

What was meant to be a secure environment for high-level automated finance was turned into an open vault as a hacker managed to siphon 1,299 Ether from the protocol’s DUSD/USDC pool on Curve.

The breach, which unfolded with clinical precision, highlights a persistent vulnerability in how decentralized platforms interpret external data.

Security firm PeckShield was among the first to flag the suspicious movement, noting that the attacker targeted non-custodial liquidity providers by manipulating the very information the system relies on for pricing.

How Did Flash Loans Break The Oracle

The attacker’s strategy relied on a massive temporary loan to create an illusion of value.

According to a security engineer at CertiK, the process began when the perpetrator took out a flash loan of 280 million USDC.

This capital was not used to trade, but rather to interfere with the MachineShareOracle, the component responsible for telling the Curve pool what its shares were worth.

By injecting 170 million USDC into specific points of the protocol mid-transaction, the hacker skewed the internal pricing data.

The CertiK engineer explained,

“A share-price oracle was pushed mid-tx, letting a Curve pool pay out at an inflated rate. ~5.1M USDC left the DUSD/USDC pool, the attacker profits about 4.1M.”

Essentially, the protocol was tricked into believing its assets were far more valuable than they actually were, allowing the hacker to swap 110 million USDC against a pool that only held about $5 million in real liquidity.

Did An MEV Builder Snatch The Profits

In a strange twist of on-chain irony, the hacker did not walk away with the full amount they initially drained.

As the exploit was being executed, an automated Maximal Extractable Value (MEV) builder identified the opportunity and frontran the transaction.

This MEV entity, using an address starting with 0xa6c2, effectively "stole from the thief," capturing a significant portion of the value as the exploit played out.

CertiK estimates that this builder seized approximately $4.14 million of the $5 million withdrawn.

This sophisticated interception meant that while the pool was emptied, the original attacker had to settle for a split of the remaining assets.

The stolen funds were eventually converted into 1,299 ETH and distributed between two primary digital wallets.

Where Is The Stolen Ethereum Now

Blockchain trackers are currently focused on two specific addresses holding the spoils of the attack.

One wallet, 0xbed2…dE25, is holding roughly $3.3 million in ETH, while a second, 0xE573…f905, contains 276 ETH valued at approximately $880,000.

So far, the funds have remained stationary, avoiding the usual path toward mixing services or centralized exchanges where they could be frozen.

While the 1,299 ETH remains under a microscope, Makina Finance issued a brief statement at 6:42 AM UTC Tuesday, clarifying that the infrastructure of the entire protocol was not compromised.

On X, Makina Finance has urged liquidity providers in the DUSD pool to withdraw their remaining funds immediately while they determine “the appropriate next steps for affected users and LPs.”

Can Defi Recover From $16 Billion In Fraud

This incident adds to a grim tally for the broader crypto market, which is still reeling from a massive wave of illicit activity throughout 2025.

Data from the Cyvers Web3 Security and Fraud Report reveals that last year saw over $16 billion swindled through 108 distinct security incidents.

With nearly 19,000 active fraud networks identified globally, the Makina Finance exploit serves as a cold reality check for the industry.

Despite Makina’s status as an institutional-grade platform with over $100 million in total value locked, the breach proves that even the most well-capitalized protocols are vulnerable to the rapid-fire logic of flash loan attacks and oracle manipulation.