Makina Finance suffers $5 million stablecoin pool exploit: CertiK

Decentralized finance protocol Makina Finance is the latest victim of a sophisticated smart contract exploit, with blockchain security firm CertiK reporting that roughly $5 million was drained from one of the protocol’s stablecoin pools.

CertiK flagged the incident on Tuesday, detailing that an attacker used a 280 million USDC flash loan to manipulate the protocol’s oracle and drain funds.

Makina Finance is a DeFi execution engine that launched operations in February 2025, according to its social media posts. The protocol, which describes its offerings as institutional-grade strategy vaults, currently holds $100.49 million in total value locked, according to DefiLlama data.

According to CertiK’s analysis, the exploiter executed a complex attack on the protocol’s DUSD/USDC Curve stablecoin pool. The attacker borrowed 280 million USDC, used 170 million of it to manipulate the MachineShareOracle that the pool depends on for pricing, and then traded 110 million USDC against the roughly $5 million pool to drain its assets.

Other security firms reported varying loss estimates. GoPlus Security approximated the damage at $5.1 million, while PeckShield quantified it at about $4.13 million worth of ether. In a notable post-attack development, an MEV builder captured the majority of the funds, seizing $4.14 million, according to CertiK.

Makina’s team has not formally confirmed the exploit on its official X account or Telegram channels. In a statement posted to its Discord server early Tuesday, the team said it was “aware of posts circulating about a potential incident” and was “still verifying the information.”

Approximately two hours later, a second Discord update stated the issue “appears to be isolated to DUSD LP positions on Curve” and recommended liquidity providers withdraw funds, but the team did not acknowledge a loss.

The Block has reached out to the Makina Finance team for comment.

This breach occurs after a year marked by significant crypto theft. According to a Chainalysis report, cryptocurrency theft totaled over $3.41 billion in 2025. North Korea was the most prolific threat actor, stealing a record $2.02 billion.