MakerDAO ETH-A flip keeper (third-party bot) hack — October 2026
Incident facts
| Date of incident | |
|---|---|
| Publicly disclosed | October 6, 2026 |
| Target type | Other |
| Loss | $539,800Price at time of incident |
| Method | Access control flawA dormant liquidation keeper from 2020 had a drain function without the ds-auth check its other functions carried, so anyone could make it settle its four unsettled ETH-A auctions and withdraw the freed 200 WETH to an address of their choosing |
| Chains | Ethereum |
| Outcome | Unresolved |
What happened
A third-party liquidation keeper that had bid in MakerDAO's ETH-A collateral auctions in 2020 lost 200 WETH on 6 October 2026. The keeper, an upgradeable proxy contract run by an unidentified operator, had won four ETH-A auctions in 2020, numbers 1457 to 1460 for 50 WETH each, but never called deal() to close them, so the 200 WETH had sat in MakerDAO's ETH-A Flipper contract for six years.
According to Defimon Alerts and a reconstruction by DeFiHackLabs, one function in the keeper's implementation was missing the ds-auth access check that guarded its other functions. An address funded through Tornado Cash called it: the keeper settled its four old auctions, moved the collateral to itself inside MakerDAO's accounting, and withdrew 200 WETH through the ETH join adapter to a recipient chosen by the caller, which unwrapped it to ETH. MakerDAO's own contracts behaved as designed; the flaw was in the third-party keeper.
This registry read the transaction receipt: it was mined in Ethereum block 26,131,471 at 06:13:11 UTC and moved exactly 200 WETH out of the ETH-A join adapter. At the CoinGecko ETH price of about $2,699 for that hour that is about $539,800; Defimon Alerts and SlowMist put it at about $538,000. No owner of the keeper has come forward and no recovery has been reported.
Sources
- Defimon Alerts on XSecondary · retrieved 2026-10-09
- DeFiHackLabs exploit reconstructionSecondary · retrieved 2026-10-09
- Ethereum transaction receipt, read by this registryOn-chain · retrieved 2026-10-09
Changes to this entry
- Recorded from Defimon Alerts, the DeFiHackLabs reconstruction and this registry's reading of the transaction. The keeper's operator is unknown.
Cite this
This data is published under CC BY 4.0. You may reuse it, including commercially, as long as you credit iTokenly and link back.
iTokenly Hack Registry, "MakerDAO ETH-A flip keeper (third-party bot) hack — October 2026", iTokenly, accessed 2026-10-09, https://itokenly.com/hacks/makerdao-eth-a-flip-keeperhttps://itokenly.com/hacks/makerdao-eth-a-flip-keeperPermalinks never change. If an entry is renamed, the old address keeps working.
Spotted an error? Write to [email protected]. Corrections to published figures are logged on this page. See the methodology for how entries are checked.