MakerDAO Legacy Auction Keeper Incident Analysis
ID: baf33f0e-91ae-5ba2-9feb-f5d72ba2821a
STIX ID: report--baf33f0e-91ae-5ba2-9feb-f5d72ba2821a
Feed Name: CertiK Blog
Threat Score
On 2026-10-06 an attacker exploited a missing access control in a MakerDAO keeper contract to drain 200 ETH (~$542,982) from four unsettled legacy auction lots. The attacker deployed an adapter module, caused the keeper to grant Vat.hope delegation to that module, executed auction settlements that credited collateral to the keeper, used the delegation to transfer the 200 ETH out as WETH, and started laundering the proceeds through Tornado Cash within minutes.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.