Makina Finance, a player in decentralized finance, was recently targeted in a technical security breach involving its smart contracts. The attack was highlighted by CertiK, a blockchain security firm, which disclosed the theft of around $5 million from a stablecoin pool on Makina Finance’s platform. The breach utilized a high-volume flash loan to manipulate a price oracle, reflecting a disturbing trend of rising crypto heists in 2025.
What Was the Attack Mechanism?
The attack took aim at Makina Finance’s DUSD/USDC Curve stablecoin pool, according to CertiK’s findings. The assailant initiated the maneuver with a colossal 280 million USDC flash loan. They strategically deployed 170 million USDC to disrupt the MachineShareOracle, impacting pool pricing. The assailant then used the residual 110 million USDC, draining nearly $5 million from the pool.
Diverging estimates from different security firms indicate the complexity of evaluating the breach. GoPlus Security estimated the financial damage at about $5.1 million, whereas PeckShield computed the assets withdrawn equated to roughly $4.13 million in ETH. Notably, CertiK’s review pointed out the involvement of an MEV builder, which took over a significant amount of the diverted funds, capturing close to $4.14 million.
Did Makina Finance Respond Promptly?
Makina Finance initially refrained from confirming the breach on their standard communication platforms like X or Telegram. The first acknowledgment of the event unfolded on their Discord on a Tuesday morning, where they addressed public speculations while conducting due verification. A subsequent communication advised liquidity providers to retract their assets, focusing specifically on the DUSD positions on Curve. Notably, they stopped short of confirming the full scope of losses.
This incident fits a troubling pattern witnessed in 2025, with an alarming surge in crypto-related crimes. Chainalysis reported over $3.41 billion lost to crypto thefts, attributing $2.02 billion of it to North Korean-affiliated groups.
Makina Finance, set up in February 2025, is noted for providing institutional-grade financial services with a focus on DeFi. At the breach’s occurrence, according to DefiLlama, the platform’s total locked asset value was $100.49 million.
The following conclusions can be drawn from this incident:
- Smart contract vulnerabilities are crucial security concerns to address.
- Flash loan exploits continue to pose significant threats to DeFi systems.
- The importance of robust oracle mechanisms in maintaining platform integrity is evident.
This breach accentuates the severe threats posed by significant flash loans in DeFi platforms, stressing the urgent need for advanced security measures.
