Legacy MakerDAO auction keeper drained of 200 ETH

200 ETH ('$542,982 at the time of the exploit'), per CertiK. Defimon: ~$538K.

Root cause: Per CertiK: 'a missing access control on function 0x8804d1de in keeper implementation 0x68399ed8aa33C5b43F863EE6782de492006A5546.' The function called Vat.hope on any caller-supplied address and then called into it, giving the attacker's module control of the keeper's Vat account.

Timeline, as sourced: Exploit tx 6 Oct 2026 06:13:11 UTC (on-chain); Tornado Cash deposits from 06:19:35 UTC (per CertiK).

On 6 October 2026 at 06:13 UTC an attacker drained 200 ETH from a legacy auction-keeper contract on Ethereum, according to CertiK's incident analysis (opens in a new tab). The keeper had won four 50 ETH lots of ETH-A collateral with zero bids during MakerDAO's March 2020 liquidations and never settled them. CertiK says function 0x8804d1de in the keeper's unverified implementation lacked the ds-auth check that guards its other privileged functions: it accepted any address, gave it delegation over the keeper's Vat account with hope(), then called into it. The attacker's module settled auctions 1457 to 1460, moved the 200 ETH of collateral out through the ETH-A GemJoin and sent it to the attacker, who began depositing it into Tornado Cash six minutes later. Defimon (opens in a new tab) describes the flaw as the third-party keeper's unprotected function and says MakerDAO's core contracts behaved as designed. The exploit transaction (opens in a new tab) is public.