Details of the Breach
Makina Finance experienced a significant flash loan exploit on January 20, leading to a loss of approximately $4.1 million. The attacker successfully drained 1,299 ETH from the protocol by leveraging MEV bots to front-run transactions.
Blockchain security firm PeckShieldAlert reported on X that the exploit targeted the Dialectic USD/USDC Stableswap pool, where the attacker manipulated the pool's price. On-chain data confirms the loss of about 1,299 ETH, valued at around $4.13 million.
According to CertiKAlert, the breach commenced with the hacker borrowing a flash loan of 280 million USDC. Subsequently, using 170 million USDC, the attacker manipulated the MachineShareOracle, which is critical for pricing in the DUSD/USDC pool. This manipulation allowed the attacker to swap 110 million USDC through the pool, extracting an estimated $5 million in value.
A MEV bot, operating from the address 0xa6c2, executed a series of rapid trades that front-ran the attacker's transaction, resulting in the draining of approximately 1,299 ETH from the pool. The stolen funds were later distributed to two addresses: 0xbed2 received roughly $3.3 million, and 0x573d retained $880,000.
Makina Finance acknowledged the incident on their social media, stating,
"Gmak, early this morning we received reports regarding an incident with the $DUSD Curve pool."
The firm's team clarified that the issue is confined to its DUSD liquidity provider positions on Curve, with no indications of other assets or deployments being affected. They also confirmed that the underlying assets stored within the machines remain secure.
As a precautionary measure, security mode has been activated across all machines while the team continues its assessment. Liquidity providers in the DUSD Curve pool have been advised to withdraw their funds.
In a separate incident, CyversAlerts has flagged suspicious transactions involving SynapLogic on Base. Reports suggest the hacker was initially funded through Tornado Cash on Ethereum before bridging funds to Base via GasZip and acquiring approximately 144,000 SYP tokens. However, SynapLogic later confirmed that the issue has been fully resolved, with their systems operating normally and all user funds remaining safe.
Truebit Protocol Hack
This event follows closely on the heels of the first major DeFi hack of 2026. The Truebit Protocol recently experienced a security breach, resulting in the loss of approximately $26.5 million in ETH. Investigations revealed that the hacker exploited a vulnerability within the smart contract's pricing logic, which enabled them to mint TRU tokens without any cost.
Following the exploit, the project's team announced that they were investigating the situation. At the time of this report, no official recovery plan has been disclosed, and the exploited funds remain on the blockchain.
Meanwhile, on-chain security firms such as SlowMist and Certik have published post-mortems, cautioning that the use of outdated Solidity versions continues to pose a systemic risk within the DeFi space. SlowMist recommended that such systems should implement the SafeMath library to prevent logic vulnerabilities arising from integer overflows.