DeFi Disaster: $5M Drained in Oracle Nightmare

Makina Finance fell victim to a $5 million flash loan attack on January 20, 2026, draining its DUSD/USDC stablecoin pool via oracle manipulation.

As it happens, CertiK and security firms flagged the exploit, with the attacker netting $4.14 million routed to an MEV builder. As decentralized finance (DeFi) inflows surge, this breach raises alarms over protocol vulnerabilities and user fund safety.

Security alerts from CertiK, TenArmor, and other platforms revealed the attack on Makina Finance on the Ethereum blockchain. The transaction, executed at 03:40 UTC, involved a flash loan of 280 million USDC. As CertiK explained:

1/ The exploiter flashloaned 280M USDC, used 170M to manipulate MachineShareOracle that the DUSD/USDC pool depends on, and traded 110M on the ~$5M pool to drain it. pic.twitter.com/QAEF25K3AC

— CertiK Alert (@CertiKAlert) January 20, 2026

The exploiter used 170 million USDC to manipulate the MachineShareOracle, inflating the prices in the DUSD/USDC Curve pool. Then, 110 million USDC was swapped to drain the pool of around $5 million, profiting from the discrepancy.

Internal traces show multiple add/remove liquidity calls on Curve and Aave, with USDC approvals and token exchanges across pools like DAI/USDC/USDT and MIM-3LP3CRV-f. Funds were converted to 1,299 ETH (~$4.13–$5.1 million) and sent to MEV builder 0xa6c2…387.

Makina confirmed the issue affects only DUSD LP positions on Curve, advising withdrawals. No other deployments impacted, per the statement.

Why This DeFi Hack Signals Bigger Risks Ahead

The exploit underscores oracle manipulation as the top DeFi threat, enabling flash loans to exploit pricing flaws without collateral. Losses hit $5 million, but the attacker’s profit was around $4.1 million after fees.

🚨TenArmor Security Alert🚨

Our system has detected a suspicious attack involving #Makina Finance @makinafi on #ETH, resulting in an approximately loss of $4.2M.

It appears that the Makina's DUSD/USDC CurveStable pool was drained!

Attack transaction: https://t.co/wvTPzkMLP1… pic.twitter.com/qUaDF5mxWA

— TenArmorAlert (@TenArmorAlert) January 20, 2026

Meanwhile, DeFi hacks persist into 2026, with legacy platforms losing $27 million recently. Makina’s permissionless AUM refresh allowed mid-tx oracle tweaks, a design flaw.

#PeckShieldAlert @makinafi has been exploited for ~1,299 $ETH (~$4.13M).

The hacker was frontrun by MEV Builder (0xa6c2…).

The stolen funds are currently held in 2 addresses:
0xbed2…dE25 ($3.3M) & 0x573d…910e ($880K) pic.twitter.com/Q5WzHpfq7j

— PeckShieldAlert (@PeckShieldAlert) January 20, 2026

For users, revoke approvals and avoid affected contracts. Protocols must audit oracles rigorously, and Chainlink or multi-source could mitigate. Amid $2.17 billion weekly inflows, such events could erode trust but highlight maturation needs.