Yesterday, the multi-chain DeFi execution engine Makina was hacked, but upon closer inspection, the impact was actually limited—mainly affecting users providing liquidity to the Curve DUSD/USDC pool. If you hold positions in DUSD, Pendle, or Gearbox, there's generally no need to worry too much.

The attack method is not particularly novel: hackers manipulated the pool’s prices to artificially inflate the book value of liquidity providers’ assets, then exploited this for arbitrage. As a result, a total of 5,107,871 USDC was directly lost on the Ethereum network.

The good news is that the Makina team responded quickly. They took a snapshot backup of the Curve DUSD/USDC pool before the attack and have already gathered some clues about the hacker’s identity, actively reaching out. If you are still providing liquidity in this pool, the official recommendation is to withdraw unilaterally to DUSD and wait for further instructions. The team’s current plan is to disable the recovery mode and restart the redemption function.

Overall, although these kinds of attacks are always frustrating, in terms of response efficiency and transparency, the process has been relatively standard.