On January 20, 2026, Makina’s on‑chain yield engine lost about $4 million when attackers hijacked its DUSD/USDC Curve stableswap pool. By feeding forged data from external Curve integrations into Makina’s Caliber accounting contract, the attacker inflated AUM and sharePrice in a single flash‑loan‑driven transaction across the protocol in the same

Attackers first borrowed large flash loans from Morpho and Aave V2, injected them into multiple Curve pools, and then added liquidity to Makina’s DUSD/USDC pool. The temporary price distortion pushed sharePrice from ~1.01 to ~1.33, letting the attacker drain USDC reserves and exit with ~1,299 ETH in the same transaction and profit

Makina halted operations, offered LPs withdrawal options, and hired security firms for recovery. The incident underscores a recurring DeFi flaw: over‑trusting external liquidity data without safeguards. Experts warn that future protocols must embed rate limits, time‑weighted AUM, and flash‑loan resistance to prevent similar breaches in the next generation of protocols.