Incident Overview
A Tornado Cash-funded address called an unprotected drain function on a dormant MakerDAO ETH-A liquidation keeper. The upgradeable proxy had won auctions #1457–1460 in 2020 (200 WETH total) but never called deal(), leaving the collateral in the Flipper. The attacker called deal(), moved the collateral to the keeper via Vat.flux, then used GemJoin.exit() to withdraw 200 WETH to an attacker-chosen address and unwrap it to ETH. The flaw was in the third-party keeper, not MakerDAO core.
Sources & References
This record presents information attributed to the linked sources. Incident dates describe the original event, not a new report. Reported loss figures reflect the source record and are not current market valuations.