Makina Finance Loses $4.1M in Flash Loan Exploit

A sophisticated flash loan exploit targeted Makina Finance, a decentralized finance protocol on the Ethereum blockchain, early on January 20, 2026, resulting in the theft of approximately 4.1 million in cryptocurrency from its DUSD/USDC stablecoin pool on the Curve platform.

Blockchain security firms, including CertiK and PeckShield, detailed the attack's mechanics. The exploiter initiated the breach by borrowing a 280 million USDC flash loan. Of that amount, 170 million USDC was used to manipulate the MachineShareOracle, a pricing mechanism relied upon by the DUSD/USDC pool. This manipulation allowed the attacker to swap 110 million USDC, draining the pool of roughly 1,299 ETH, valued at about 4.13 million at the time. An MEV bot, operating from the address 0xa6c2, frontrun the transaction, executing rapid trades to capture the majority of the funds. The stolen assets were then split between two Ethereum addresses: 0xbed2dE25, holding around 3.3 million, and 0xE573f905, with approximately 880,000. Onchain trackers have noted no further movement of these funds as of the latest reports, though analysts continue to monitor for potential transfers to mixers or exchanges.