On January 20, 2026, DeFi protocol Makina Finance became the target of a high-speed digital heist. An attacker used an oracle manipulation technique to drain approximately $5.1 million from one of its stablecoin pools. Built as an "institutional-grade" vault, the protocol proved that even the biggest vaults have a weak spot when someone knows exactly where to push.
The most striking twist: the original hacker got "mugged" mid-heist. As the attacker tried to pull off the job, a specialized MEV (Maximal Extractable Value) bot spotted the pending transaction, jumped ahead, and walked away with $4.14 million of the loot. The attacker did the hard work; the bot grabbed the prize.
The Oracle Trick: How Millions Vanished
The attacker used a classic oracle manipulation tactic. They first borrowed a massive $280 million flash loan in USDC — no collateral needed, just a promise to repay within seconds. With that mountain of cash, they flooded the system to trick the MachineShareOracle, the digital price tag the protocol relies on. By skewing the numbers, they made the protocol believe its shares were far more valuable than reality. Like a grocery store glitch turning a $1 loaf into $100, the attacker used that fake valuation to drain the DUSD/USDC Curve pool of over 1,299 ETH.
Market Context: Ethereum Under Pressure
As of January 20, Ethereum (ETH) is trading at $3,111.04, down 3.4% in 24 hours. The global crypto market cap slid roughly 3% to $3.21 trillion, driven by broader risk-off sentiment. ETH remains about 37% below its all-time high of $4,953.73 set in August 2025.
Where the Money Is Now
The stolen funds sit in a few specific wallets under close watch by security firms CertiK and PeckShield. Around $3.3 million sits in one address, with another $880,000 parked in a second. Makina Finance has triggered Security Mode across all automated vaults. The team confirmed the damage is limited to DUSD liquidity positions on Curve; other underlying assets remain safe. They urge all users with funds in the DUSD Curve pool to withdraw immediately while they assess potential recovery options.
The attack strikes as the crypto world hoped for a calmer 2026 after billions lost in 2025. It’s a stark reminder: in DeFi, code is law — but if that code has a single crack, someone (or some bot) will eventually find it.