Attacker drains 200 ETH from a MakerDAO keeper that never settled its 2020 Black Thursday auctions

On October 6, an attacker took 200 Ether (ETH), worth about $538,000, from a dormant liquidation "keeper" on Ethereum. A keeper is a bot contract that bids in MakerDAO collateral auctions. During the March 2020 crash known as Black Thursday, this keeper won four ETH-A liquidation auctions, numbered 1457 to 1460, each for 50 wrapped Ether (WETH). It never called the settlement function, and the 200 WETH sat untouched in MakerDAO's ETH-A auction contract for six years.

The root cause was a missing access control. The DeFiHackLabs proof of concept shows that one function in the keeper's implementation, selector 0x8804d1de, had no authorization check, while the rest of the contract was protected. Through that function, the attacker made the keeper settle the four stale auctions, which credited the 200 WETH to the keeper's internal balance. The attacker then had the keeper grant spending rights over that balance to an address the attacker controlled. That address withdrew the WETH through MakerDAO's collateral adapter and unwrapped it to Ether. Protos reported that the proceeds went through Tornado Cash in 10-ETH lots. MakerDAO's core contracts were not affected. The flaw sat in the third-party bot, and no recovery or attribution has been reported.

The same day, attackers made two passes at a legacy Set Protocol product, ETHMACOAPY, and took about 8.11 WETH, according to the security firm ExVul. The bug was in rounding. A public fee function with no access gate recomputed the product's unit shares with a round-up division, which moved the value from 4,927 to 4,928 even when no fee was due. The attacker issued shares, triggered the bump, and redeemed the same quantity at the higher unit value. Uniswap v4's fee-free flash accounting supplied the temporary capital needed to turn a one-unit rounding edge into a profit. The reproduced transaction nets about 5.08 ETH.

In New York, a federal jury on October 7 convicted Jonathan Spalletta of computer fraud and money laundering for two April 2021 attacks on Uranium Finance, a decentralized exchange on BNB Chain. The jury deliberated for about two hours. TokenPost puts the take at $54.7 million. The exploit used a mismatched constant in the pools' balance check. Prosecutors said Spalletta moved funds through Tornado Cash and spent proceeds on rare Pokémon and Magic: The Gathering cards. Authorities seized the cards and about $31 million in crypto. Sentencing is set for February 16, 2027.