Leaderboard
360All-time rank
Makina
Jan 20, 2026
$4.2M
Lost
$4.2M
Recovered
$3.4M
Net loss
$790K
Majority81% recovered
An attacker took a $280M flashloan and used $170M to manipulate Makina's sharePrice oracle via three compounding flaws: permissionless oracle updates, synchronous Curve spot prices with no TWAP, and pre-approved Weiroll paths. 2M.
How the exploit worked
View reproducible PoCPrice Oracle Manipulation.
Lost: 5.1M USD
Source: DeFiHackLabs (SunWeb3Sec)
- Target
- DeFi
- Classification
- Oracle Manipulation
- Technique
- Spot Price Manipulation
- Attribution
- Unknown
- Chains
Ethereum
Event timeline
- Jan 20, 2026Exploit executed — $4.2M drained via spot price manipulation
- Attributed to Unknown
- Recovery status Majority 81%
Data credits
- DefiLlamaIncident record, amounts, chains, recovery data and logo
- DeFiHackLabsExploit analysis and reproducible proof-of-concept (by SunWeb3Sec)