MakerDAO ETH-A Liquidation Keeper Bot exploit — $538k lost on Ethereum
MakerDAO ETH-A Liquidation Keeper Bot lost an estimated $538k on Ethereum (improper access control), according to the DeFiLlama hacks database. Users and integrators should review exposure and follow the project's official channels.
Vuln-watch · relayed from the DeFiLlama hacks database; see Source & attribution below
Summary
MakerDAO ETH-A Liquidation Keeper Bot lost an estimated $538k on Ethereum (improper access control), according to the DeFiLlama hacks database. Users and integrators should review exposure and follow the project's official channels.
Incident
- Protocol: MakerDAO ETH-A Liquidation Keeper Bot
- Date (UTC): 2026-10-06
- Estimated loss: $538k
- Chain(s): Ethereum
- Technique: Improper Access Control
- Classification: Access Control
- Target: DeFi Protocol
Recommended actions
- Revoke token approvals granted to MakerDAO ETH-A Liquidation Keeper Bot contracts until the project confirms they are safe
- Integrators: pause or delist affected assets and monitor for attacker fund movements
- Beware of follow-on phishing: ignore unofficial "refund", "recovery", or "claim" links and DMs; use the project's verified channels only
Source & attribution
This 0xCERT advisory relays an incident recorded in the DeFiLlama hacks database (https://defillama.com/hacks). Figures are preliminary estimates and may be revised; refer to the project's own post-mortem for the authoritative record. Report additional details to 0xCERT at https://www.0xcert.com/report.
References
Indicators of compromise
All IOC feeds →- address0x01eb957e5c7dcddd60f3c875956ccc6fb9bda5faAttacker EOA (CertiK) · Ethereum
- address0xec997d2ad033277913d6002277353368e8321dcfAttack contract (CertiK) · Ethereum
- address0xf09a13072ed939b79bc25b66aa3a836ea6dcc170Malicious adapter module used in exploit (CertiK) · Ethereum
- tx0x4a587af4213cc345c4c109fbf5fec46f9643183f91a9edf60305380f31ad1167Attack contract deployment (CertiK) · Ethereum
- tx0xb8ecff9c129d8d9331c85558eaeddff29a38c4c16b71a40986acbf8f6febefebFirst Tornado Cash deposit of proceeds (CertiK) · Ethereum
- tx0xbb6940f7c2a1e68cafbae7bb9b94d09af9af06ec3a114f6996f2cab993f3a88cExploit transaction (CertiK) · Ethereum
- tx0xd4c0b18a058e7f0a12855f30174f4cb1e973c15c886063deab97e1a21f048ac6Attacker funding via Tornado Cash withdrawal (CertiK) · Ethereum
OpenPGP-signed. The signed text of this advisory verifies against the 0xCERT key CCC7 D9EC 9415 723D.
Published 2026-10-06 · last updated 2026-10-08
curl -s https://www.0xcert.com/pgp.asc | gpg --import && curl -s https://www.0xcert.com/advisory/0xCERT-2026-0154/signed.txt | gpg --verify