# Attacker Drains 200 WETH From Abandoned MakerDAO Keeper That Never Settled 2020 Auctions

A missing access check on one function let the attacker take control of the dormant bot's position in Maker's core accounting contract and withdraw about $540,000, and the stolen ether entered Tornado Cash within six minutes.

- Published: 2026-10-09T05:49:33.680Z
- Canonical: https://polylog.news/crypto/2026-10-09/attacker-drains-200-weth-from-abandoned-makerdao-keeper-that
- Publisher: Polylog (Crypto desk)
- Section: crypto
- Sources: [DeFiHackLabs](https://github.com/SunWeb3Sec/DeFiHackLabs/commit/4391e923fa427dc28f5e8f90d5592dfee397859a), [DeFiHackLabs](https://github.com/SunWeb3Sec/DeFiHackLabs/commit/560ed46c021c6c50e910b143a969d11b07a9f14c), [DeFiHackLabs pull request](https://github.com/SunWeb3Sec/DeFiHackLabs/pull/1295), [The Crypto Times](https://www.cryptotimes.io/2026/10/06/dormant-makerdao-keeper-drained-of-538k-core-remains-intact/), [KuCoin News (Defimon alert)](https://www.kucoin.com/news/flash/defimon-alerts-200-weth-stolen-from-dormant-makerdao-liquidation-bot-proxy)

On October 6, an attacker took 200 wrapped ether (WETH), worth about $538,000 to $543,000 at the time, from a liquidation keeper that a third party had deployed for MakerDAO's collateral auctions in 2020. The security monitor Defimon [flagged the theft](https://www.kucoin.com/news/flash/defimon-alerts-200-weth-stolen-from-dormant-makerdao-liquidation-bot-proxy). Researchers have since added a working reproduction to the DeFiHackLabs repository ([commit](https://github.com/SunWeb3Sec/DeFiHackLabs/commit/4391e923fa427dc28f5e8f90d5592dfee397859a), [earlier commit](https://github.com/SunWeb3Sec/DeFiHackLabs/commit/560ed46c021c6c50e910b143a969d11b07a9f14c)).

The keeper, an upgradeable proxy, won four ETH-A collateral auctions during the March 2020 crash known as Black Thursday (auction IDs 1457 to 1460, 50 WETH each). It never called `deal()` to settle them, so the 200 WETH stayed in Maker's ETH-A Flipper contract for six years. According to the [DeFiHackLabs pull request](https://github.com/SunWeb3Sec/DeFiHackLabs/pull/1295), the function at selector 0x8804d1de has no authorization. It decodes an address and an amount and runs its body without checking the caller or the owner.

The attacker used that function to make the keeper settle the four stale auctions, which credited 200 WETH to the keeper's balance in the Vat, Maker's core accounting contract. The attacker then had the keeper call `vat.hope()` to authorize a worker contract the attacker supplied. The worker moved the collateral out through the join, flux and exit functions and unwrapped it to ether. The attack is an access-control failure. The funds reached the attacker's wallet within a minute, and [Tornado Cash deposits began six minutes later](https://www.cryptotimes.io/2026/10/06/dormant-makerdao-keeper-drained-of-538k-core-remains-intact/) in 10-ether batches. No freeze, recovery or attribution has been reported. MakerDAO's core contracts, which now back Sky's USDS ($7.03 billion in circulation according to DeFiLlama) and DAI ($4.77 billion), were not affected.

## What this means

The loss fell on whoever owned the keeper. DAI and USDS holders were not affected. The precedent still matters: early DeFi left behind many small contracts that hold claims inside immutable core systems, and many have no active owner and no monitoring. Attackers now have cheap tooling, including AI-assisted bytecode analysis, to scan those contracts for unprotected selectors. Each unprotected contract is a no-cost opportunity for whoever finds it first. The precedent is the 2024 to 2025 series of drains on deprecated contracts after projects moved to new versions. Those drains continued until teams swept residual balances. The likelier outcome over the coming weeks is more drains of dormant contracts on Ethereum that still hold claims in Maker, Compound v1 and Uniswap v1 era systems, unless white-hat groups sweep them first. A coordinated sweep or bounty effort covering legacy keeper balances would prove this wrong.

## What to watch

- Whether Sky governance or white-hat groups publish a list of other legacy keepers with unsettled auction balances. Those contracts are the next obvious targets.
- Whether the Tornado Cash deposits are linked to a known actor. That would show whether this was opportunistic scanning or a group working through old contracts.