News · Security & Hacks
A legacy keeper contract lost $542,982 in ETH-A collateral after an unauthenticated function let an attacker settle and claim unsettled 2020 auction lots.
Key point 1 of 3
01
An attacker drained 200 ETH ($542,982) from a legacy MakerDAO auction-keeper contract on Oct. 6 .
Key point 2 of 3
02
The keeper possessed unsettled lots won with zero bids during MakerDAO's March 2020 Black Thursday crash .
Key point 3 of 3
03
Missing access control allowed the attacker to gain full delegation over the keeper's Vat balance and route proceeds to Tornado Cash .
Context
MakerDAO suffered severe auction liquidations during the March 2020 market crash, leaving multiple zero-bid auctions uncollected onchain in keeper contracts for years.
Why it matters
The loss is isolated to the private operator of the legacy auction-keeper contract, with no direct loss to MakerDAO's active protocol reserves.
What to watch
Monitoring onchain addresses linked to Tornado Cash deposits to track potential further laundering of the remaining stolen ether.
Sources
Built from 1 primary source, machine-checked before publication.
Keep reading
Read the full story
AI-generated, source-verified. Sources, citations and live prices on the article page.