Attacker Drains 200 ETH From Dormant MakerDAO Auction Keeper

An attacker drained 200 $ETH ($542,982 at the time of the incident) from an unmaintained MakerDAO auction-keeper contract on Ethereum mainnet on Oct. 6, according to an analysis by blockchain security firm CertiK ¹. The stolen assets stemmed from four 50 ETH lots won with zero bids during MakerDAO's "Black Thursday" liquidations in March 2020 that were left unsettled ¹.

CertiK reported that the breach exploited an access control omission in keeper implementation 0x68399ed8aa33C5b43F863EE6782de492006A5546 ¹. While other sensitive functions required authorization checks, an unauthenticated method allowed any caller to register an arbitrary adapter module ¹. Upon invocation, the keeper executed Vat.hope(), giving the malicious module complete authority over the keeper's internal balance in MakerDAO's core accounting contract before invoking an execution callback ¹.

Unsettled Collateral and Fund Movement

Inside the callback, the attacker's module initiated settlement on the retired ETH-A Flipper contract for auctions 1457 through 1460 ¹. Because any entity can settle finalized auctions, the contract credited 200 ETH of ETH-A collateral to the keeper's internal balance, which the attacker immediately transferred away using the freshly granted delegation ¹. The attacker then exited the position through the ETH-A GemJoin contract and forwarded the funds as wrapped ether ¹.

Blockchain records show the operation was funded through an initial 0.1 ETH withdrawal from Tornado Cash minutes before the attack ¹. Six minutes after the exploit transaction confirmed, the perpetrator began laundering the stolen capital through the privacy mixer in 10 ETH increments ¹. MakerDAO governance systems were not directly modified during the incident, as the vulnerability resided entirely within a third-party legacy keeper proxy rather than MakerDAO's active core contracts ¹. At the time of writing, MakerDAO's governance token $MKR traded at $1,844, down 7.9% over the past 24 hours.