A vulnerability from 2020, still remembered in 2026—200 ETH stolen from MakerDAO!
On March 12, 2020, Ethereum crashed, and a series of “zero-bid” liquidation auctions appeared on MakerDAO—someone used 0 DAI to win collateral worth 50 ETH.
Six years later, someone dug up the incident.
On October 6, an attacker entered via Tornado Cash and exploited a function in an old keeper contract that lacked access control (0x8804d1de). They gained full control of the liquidation keeper, settled all four auctions from 2020 that had never been finalized (#1457-1460), and withdrew 200 ETH (about $540,000). The funds were then sent to Tornado Cash in batches of 10 ETH. (Disclosed by CertiK on October 7)
In other words: someone still remembered a code vulnerability from six years ago—and actually came back to exploit it.
Let’s break down the logic: The scariest thing in DeFi has never been “getting hacked.” It’s that “someone is always watching those old vulnerabilities you think nobody remembers.” The bad debt from 2020 was settled in 2026. How many more years do you plan to leave those old contract approvals in your wallet unrevoked?
#MakerDAO #defi $ETH
On March 12, 2020, Ethereum crashed, and a series of “zero-bid” liquidation auctions appeared on MakerDAO—someone used 0 DAI to win collateral worth 50 ETH.
Six years later, someone dug up the incident.
On October 6, an attacker entered via Tornado Cash and exploited a function in an old keeper contract that lacked access control (0x8804d1de). They gained full control of the liquidation keeper, settled all four auctions from 2020 that had never been finalized (#1457-1460), and withdrew 200 ETH (about $540,000). The funds were then sent to Tornado Cash in batches of 10 ETH. (Disclosed by CertiK on October 7)
In other words: someone still remembered a code vulnerability from six years ago—and actually came back to exploit it.
Let’s break down the logic: The scariest thing in DeFi has never been “getting hacked.” It’s that “someone is always watching those old vulnerabilities you think nobody remembers.” The bad debt from 2020 was settled in 2026. How many more years do you plan to leave those old contract approvals in your wallet unrevoked?
#MakerDAO #defi $ETH