# Attacker drains 200 ETH from a MakerDAO keeper that never settled its 2020 Black Thursday auctions

An unprotected function in a third-party liquidation bot let the attacker claim about $540,000 in stranded collateral, a rounding flaw drained a legacy Set Protocol product the same day, and a New York jury convicted the Uranium Finance hacker.

- Published: 2026-10-08T05:50:08.479Z
- Canonical: https://polylog.news/crypto/2026-10-08/attacker-drains-200-eth-from-a-makerdao-keeper-that-never-se
- Publisher: Polylog (Crypto desk)
- Section: crypto
- Sources: [DeFiHackLabs (commit)](https://github.com/SunWeb3Sec/DeFiHackLabs/commit/4391e923fa427dc28f5e8f90d5592dfee397859a), [DeFiHackLabs (commit)](https://github.com/SunWeb3Sec/DeFiHackLabs/commit/560ed46c021c6c50e910b143a969d11b07a9f14c), [DeFiHackLabs (Set Protocol commit)](https://github.com/SunWeb3Sec/DeFiHackLabs/commit/5a792da3a222730d8dfa5a49c4f94dfc9322d39b), [Protos](https://protos.com/black-thursday-revisited-makerdao-keeper-exploited-for-500k/), [The Crypto Times](https://www.cryptotimes.io/2026/10/06/dormant-makerdao-keeper-drained-of-538k-core-remains-intact/), [KuCoin News](https://www.kucoin.com/news/flash/old-set-protocol-product-ethmacoapy-loses-8-11-weth-in-attack), [Bloomberg](https://www.bloomberg.com/news/articles/2026-10-07/pokemon-collector-found-guilty-in-55-million-crypto-hack-case), [TokenPost](https://www.tokenpost.com/news/regulation/27625)

On October 6, an attacker took 200 Ether (ETH), [worth about $538,000](https://www.cryptotimes.io/2026/10/06/dormant-makerdao-keeper-drained-of-538k-core-remains-intact/), from a dormant liquidation "keeper" on Ethereum. A keeper is a bot contract that bids in MakerDAO collateral auctions. During the March 2020 crash known as Black Thursday, this keeper won four ETH-A liquidation auctions, numbered 1457 to 1460, each for 50 wrapped Ether (WETH). It never called the settlement function, and the 200 WETH sat untouched in MakerDAO's ETH-A auction contract for six years.

The root cause was a missing access control. The [DeFiHackLabs proof of concept](https://github.com/SunWeb3Sec/DeFiHackLabs/commit/4391e923fa427dc28f5e8f90d5592dfee397859a) shows that one function in the keeper's implementation, selector 0x8804d1de, had no authorization check, while the rest of the contract was protected. Through that function, the attacker made the keeper settle the four stale auctions, which credited the 200 WETH to the keeper's internal balance. The attacker then had the keeper grant spending rights over that balance to an address the attacker controlled. That address withdrew the WETH through MakerDAO's collateral adapter and unwrapped it to Ether. [Protos reported](https://protos.com/black-thursday-revisited-makerdao-keeper-exploited-for-500k/) that the proceeds went through Tornado Cash in 10-ETH lots. MakerDAO's core contracts were not affected. The flaw sat in the third-party bot, and no recovery or attribution has been reported.

The same day, attackers made two passes at a legacy Set Protocol product, ETHMACOAPY, and took about 8.11 WETH, [according to the security firm ExVul](https://www.kucoin.com/news/flash/old-set-protocol-product-ethmacoapy-loses-8-11-weth-in-attack). The bug was in rounding. A public fee function with no access gate recomputed the product's unit shares with a round-up division, which moved the value from 4,927 to 4,928 even when no fee was due. The attacker issued shares, triggered the bump, and redeemed the same quantity at the higher unit value. Uniswap v4's fee-free flash accounting supplied the temporary capital needed to turn a one-unit rounding edge into a profit. The [reproduced transaction](https://github.com/SunWeb3Sec/DeFiHackLabs/commit/5a792da3a222730d8dfa5a49c4f94dfc9322d39b) nets about 5.08 ETH.

In New York, a federal jury on October 7 [convicted Jonathan Spalletta](https://www.bloomberg.com/news/articles/2026-10-07/pokemon-collector-found-guilty-in-55-million-crypto-hack-case) of computer fraud and money laundering for two April 2021 attacks on Uranium Finance, a decentralized exchange on BNB Chain. The jury deliberated for about two hours. TokenPost [puts the take at $54.7 million](https://www.tokenpost.com/news/regulation/27625). The exploit used a mismatched constant in the pools' balance check. Prosecutors said Spalletta moved funds through Tornado Cash and spent proceeds on rare Pokémon and Magic: The Gathering cards. Authorities seized the cards and about $31 million in crypto. Sentencing is set for February 16, 2027.

## What this means

Two of the three incidents hit code that nobody actively maintains: a bot contract left over from 2020 and a deprecated Set Protocol product. Both held value their owners had forgotten about. Public proof-of-concept repositories and AI-assisted code review cut the cost of searching that backlog, and the people exposed are users and integrators whose funds still sit in contracts that teams no longer monitor. Losses of this size do not move token prices. The point is the pattern: stranded balances in abandoned contracts are now a target class of their own. The Spalletta verdict adds a second channel. A US jury treated routing stolen funds through Tornado Cash as money laundering, which raises the legal cost of that exit route for attackers who can be reached by US courts. The likelier outcome over the next several weeks is more drains of dormant contracts on Ethereum, laundered through mixers, as researchers and attackers comb the same old deployments. This read depends on legacy balances staying unclaimed. A coordinated effort by MakerDAO's successor Sky and other veteran protocols to sweep or sunset stranded funds would prove it wrong.

## What to watch

- Whether Sky, MakerDAO's successor, or other veteran protocols publish lists of legacy contracts with stranded balances. That would cut the target set before attackers reach it.
- Further DeFiHackLabs reproductions of 2020 and 2021 deployments over the coming weeks. A run of them would confirm that dormant contracts have become a systematic target.
- Spalletta's sentence in February 2027. The length of the money-laundering term will show how heavily US courts weigh mixer use.