In line with our commitment to clear and transparent communication, we are providing a further update on the incident involving the Curve DUSD/USDC pool. This remains an ongoing process, and additional updates will be shared as more information becomes available.
This update is provided for informational purposes and was prepared by the Makina team in coordination with Dialectic, the Operator of the DUSD Machine on Makina.
1) Exploit Description
The exploit involved a number of parties, and took place over an approximately 11 minute period on January 20th 2026.
At 3:40:23am UTC, in block 24273361, 0x2F934B0Fd5c4f99BAb37d47604a3a1AEADEF1CCc (0x2F93) deployed an unverified contract, which appeared to have the sole purpose of exploiting the DUSD/USDC Curve pool’s oracle price.
In the following block, 24273362, an MEV “searcher” (0x935) decompiled the original attacker contract and replicated the attack for their profit. This transaction effectively “front-ran” the initial attempt by 0x2F93 to execute the exploit. This block was confirmed by an MEV builder (0xa6c2), with the majority of the approximately 1,299. ETH in total exploit proceeds being split between the block builder and the Rocket Pool Validator that validated the block.
The exploit was isolated to the USDC side of the Curve DUSD/USDC pool. The other Curve pools (DETH/WETH and DBIT/WBTC) were not affected. All funds in the DUSD Machine remain unaffected, and DUSD remains fully collateralized.
The root cause of the exploit has been identified, and confirmed by our audit partners, to be a vulnerable Weiroll-script used for the internal accounting of a position the DUSD Machine held in the MIM-3CRV pool on Curve. The MIM-3CRV pool was manipulated by inflating the MIM price through a flashloan. The manipulated position was then accounted for in the DUSD Caliber to reflect an inflated value.
The inflated position value was then propagated to the Machine AUM, to the DUSD exchange rate, and ultimately to the DUSD/USDC Curve pool through an external oracle. The exploiter then leveraged the inflated DUSD price in the Curve pool to extract the USDC.
A patch addressing the issues is currently in development and will be going into a security audit later this week, and will be implemented through a protocol upgrade.
A full and detailed breakdown of the exploit will be published as part of a technical post-mortem at a later date.
2) Recovery Status:
Our teams are working towards recovery of the funds through various paths:
(a) Efforts to recover the remaining funds with the MEV builder, amounting to approximately 1,023 ETH as a result of the exploit, are currently underway.
(b) We are working at establishing contact with 0x573D, the Rocket Pool Validator that received approximately 276 ETH as a result of the exploit. Broad outreach efforts, together with additional forensic analysis in coordination with external security partners, are currently underway to establish communication with the owner of 0x573D.
The owner of the Rocket Pool Validator’s address is:
0x3b6fc5cc2feefc357212617930aedac9493288af
If you possess any information on how to get in direct contact with this person/entity then please direct a message through official channels to the Makina Team or email us as security@makina.finance.
(c) As part of the overall recovery efforts, Dialectic will be transferring USD 104,491 that was inadvertently earned by the DUSD Machine in Liquidity Provider fees from the volume generated on the MIM-3CRV pool during the exploit.
A snapshot of the Curve DUSD/USDC pool prior to the exploit was taken and will be used to facilitate distribution of any recovered assets to those affected, once the recovery process is complete.
We are diligently working on the fund recovery effort and will announce the distribution method and timeline for any recovered funds to users in due course. We appreciate your patience and trust in the process. For now, as an affected user, you should be withdrawing single-sided into DUSD from the DUSD/USDC Curve pool.
3) Machines Re-Activation Timeline
After the exploit occurred, Makina’s three Dialectic-operated Machines were set in Recovery Mode as a safety precaution. This prevented further Machine activities during the investigation, including redemptions. Before Recovery Mode is turned off, the implementations of the affected contracts will be updated with a patch which addresses the issue.
The development of the patch is currently in progress and it has been submitted for external audit review. Once reviewed and approved, the new contract deployments will be subject to the required timelock of 48 hours.
Subject to the successful completion of the patch audit and deployment, we are tentatively targeting Monday, January 26th, 2026 to disable Recovery Mode, which will reactivate redemptions. We will provide further updates to the community should there be any delays to this timeline.
After Recovery Mode is disabled, redemptions will resume for users who are whitelisted (ie. users who went through our AML/KYC screening). For users who are not whitelisted, secondary market liquidity for DUSD is being arranged and we have a number of parties who have expressed interest to support this as Liquidity Providers. During this time the remaining Curve pools, DETH/WETH and DBIT/WBTC will be rebalanced to provide users with better liquidity.
We kindly ask users with over 100,000 USD in DUSD and who intend to redeem, to contact us to initiate the AML/KYC screening process by opening up a ticket on Discord. (https://discord.com/invite/makinafi)
Due to the exploit in the Curve DUSD/USDC pool we intend to deprecate this pool and will opt for a more effective solution for LPs to provide liquidity through a new Uniswap pool where users can sell their DUSD into USDC at a fixed price. Shortly after Recovery Mode is turned off and the protocol is fully functional again, the Uniswap pool will be seeded - more details will be communicated through official channels in due time.
If you’re using your DUSD Machine Tokens in Gearbox, Pendle, or other DeFi protocols, you are not affected by the DUSD/USDC Curve Pool exploit. For example, if you’re in Pendle, continue to make decisions with your PT-DUSD and YT-DUSD as you best see fit.
Note to holders of DUSD/USDC Curve LP Tokens:
Please note the recovery plan for affected users will not be executed through the Curve DUSD/USDC pool.
If you are a user that was in the DUSD/USDC pool you should withdraw single-sided into DUSD. Remaining DUSD tokens in the Curve pool will not result in recovery through rebalancing, and staying in the pool does not improve recovery outcomes and may delay the process.
Thank you to all partners who have been giving assistance during this ongoing situation and to our users who have been supportive and patient while we work through this.
Seal911, Chain Security, Enigma Dark, Cantina