A legacy MakerDAO auction keeper contract was exploited, allowing an attacker to withdraw 200 ETH worth more than $500,000, according to blockchain security firm CertiK. The firm said the issue stemmed from missing access control on function 0x8804d1de in the keeper implementation contract. CertiK linked the funds to the March 2020 "Black Thursday" liquidation crisis, when the contract had won ETH with zero bids. Four lots of 50 ETH each were never settled, leaving 200 ETH in total available for withdrawal. The attacker later moved the funds out through Tornado Cash in 10 ETH increments. CertiK added that the affected contract is not part of the current core of the Sky ecosystem, but warned that older contracts still holding funds may remain exposed to similar attacks. The incident highlights how dormant contracts tied to earlier market events can continue to carry risk years later if access controls or settlement paths remain unresolved.
A legacy MakerDAO auction keeper contract was exploited, and the attacker withdrew 200 ETH worth more than $500,000, according to CertiK.
Missing access control identified as the cause
CertiK said the root cause was missing access control on function 0x8804d1de in the keeper implementation contract. That flaw allowed the attacker to remove the funds.
Funds trace back to the March 2020 Black Thursday crisis
CertiK said the contract had taken part in the March 2020 "Black Thursday" liquidation crisis. At the time, it won ETH with zero bids. Four separate 50 ETH lots were never settled, leaving 200 ETH in total. The attacker was then able to withdraw those funds.
ETH moved out via Tornado Cash
After the withdrawal, the attacker transferred the funds through Tornado Cash in batches of 10 ETH each, CertiK said.
Not part of Sky's current core system
CertiK added that the contract is not a core part of the current Sky ecosystem. Even so, older contracts that still hold funds may remain potential targets.
This article was originally published by Bit.Fan. For more cryptocurrency news and market insights, visit www.bit.fan. Disclaimer:
The market information, project data, and third-party content displayed on this platform are for industry information sharing only and do not constitute any form of investment advice or return commitment.
Cryptocurrency trading carries high risks. Users should fully assess their risk tolerance and make independent decisions. All profits, losses, and legal responsibilities are borne by the users themselves.
