Hackers have breached the decentralized project Makina Finance, siphoning off around $5 million from a stablecoin pool, according to CertiK.
#CertiKInsight 🚨
— CertiK Alert (@CertiKAlert) January 20, 2026
We have seen an exploit on @makina; the Dialectic USD/USDC Stableswap pool has been manipulated and drained for approximately $5M, with the majority, $4.14M, going to an MEV builder address.https://t.co/rgLjDVuqzD
Stay Vigilant!
The attack was made possible through oracle manipulation. By utilizing a flash loan of 280 million USDC, the attacker artificially altered price data in MachineShareOracle, which the protocol relied on.
As a result, the DUSD/USDC pool on Curve was completely drained by the cybercriminals.
The majority of the stolen assets ($4.14 million) were ultimately intercepted by an MEV builder.
Makina's developers stated they are "aware of a potential incident" and are conducting an investigation. They noted that the issue only affected the liquidity providers' positions for DUSD on Curve.
Gmak, early this morning we received reports regarding an incident with the $DUSD Curve pool
— Makina (@makinafi) January 20, 2026
At this stage, the issue appears to be isolated to DUSD LP positions on Curve. There is currently no indication that other assets or deployments are affected.
Underlying assets held in…
"As a precaution, all Machines have activated security mode while we continue to assess the situation. We strongly advise liquidity providers in the DUSD Curve pool to withdraw their funds," the team wrote.
The extent of the damage has not been specified.
Experts from GoPlus Security estimated the losses at $5.1 million, while PeckShield reported the theft of 1299 ETH ($4.1 million).
Makina Finance is a platform for executing DeFi strategies, launched in February 2025. The protocol claims to provide institutional strategic vaults.
At the time of the incident, the platform's total value locked (TVL) was $100 million.
Source: DefiLlama.A New Approach
Senior security researcher at a16z crypto, Dejun Pak, has called for the DeFi sector to integrate security directly into the code.
The foundation of this shift should be the use of standardized specifications that limit permissible actions of the protocol and automatically revert any transaction that violates predefined assumptions of "correct behavior."
"Almost every known attack could have been thwarted at the execution stage with such checks. This signifies a shift from the old paradigm of 'code is law' to a new one: 'law is specification,'" the expert emphasized.
The relevance of this proposal is underscored by hacking statistics: according to SlowMist, hackers stole over $649 million through code vulnerabilities in 2025. Even well-established protocols like Balancer lost hundreds of millions of dollars.
However, this approach has its drawbacks. Immunefi's security head, Gonzalo Magalhaes, noted in a comment to DL News that additional checks will increase gas costs, which may deter users seeking low fees.
He stated that invariant checks are a great strategy but not a "silver bullet," as they cannot account for unforeseen attack vectors.
Another issue is the complexity of properly configuring such protections. Co-founder of Asymmetric Research, Felix Wilhelm, emphasized that creating an effective invariant in practice is extremely challenging.
"For many vulnerabilities and real attacks, it is difficult or even impossible to develop an invariant that reliably catches an exploit without blocking legitimate operations in normal mode," he explained.
Such checks often only mitigate damage or serve as a signal for the team but do not completely stop the hack.
Despite these barriers, some protocols have already implemented this practice. The Solana lending protocol Kamino and developers of the XRP Ledger use invariant checks to ensure the integrity of their complex systems and protect against yet undiscovered bugs.
Recall that Immunefi CEO Mitchell Amador concluded that nearly 80% of cryptocurrency projects cease to exist after major attacks.