Key Highlights
- Makina Finance suffered a $4.13 million Ethereum (ETH) loss, with 1,299 ETH drained in a single exploit.
- The attack was front-run by a MEV builder, which captured the funds immediately after the swap.
- The stolen assets remain split across two wallets, and Makina Finance has not yet issued a statement.
Makina Finance, a DeFi protocol, was exploited early Tuesday, with about $4.13 million in Ethereum stolen, according to on-chain data reviewed by blockchain security firm PeckShield.
The attack involved the withdrawal of 1,299 ETH, which was moved out in a single transaction. PeckShield said the attacker was front-run by a MEV builder during the execution of the transaction, a detail that became clear after reviewing the on-chain flow of funds.
In a classic ‘sandwich’ or front-running maneuver, a specialized bot detected the exploiter’s pending transaction in the mempool and replicated it with a higher gas fee, effectively stealing the bounty from the original hacker.
Following the exploit, the stolen assets were traced to two wallet addresses. One address currently holds about $3.3 million, while another has roughly $880,000, according to wallet balances at the time.
Swap on Uniswap triggered the exploit
The exploit happened through a large swap on Uniswap V3, where around 4.24 million USDC was exchanged for 1,299.18 ETH, worth roughly $4.13 million at the time.
The transaction was confirmed on Ethereum block 24,273,362 at 03:40:35 UTC on January 20, 2026. Despite the size of the swap, it went through without any errors and with a gas fee of just over $0.50, showing that the transaction was executed carefully.
The swap moved liquidity through several protocols before it was finally settled. On-chain records indicate activity across Curve and Aave, with over $5.1 million in USDC passing through the transactions. Part of the swap went through Curve’s DAI and 3Crv pools before the funds were ultimately settled on Uniswap, according to blockchain data.
MEV builder intercepts the transaction
Soon after the ETH arrived in the attacker’s wallet, nearly the entire amount was transferred again, this time to an address linked to a MEV builder, identified as (0xa6c2….). The transfer happened right after the swap was completed, indicating the transaction was processed at the block-building stage.
On-chain data shows that the ETH was sent to another address before the attacker could move it, indicating MEV activity rather than a normal post-exploit transfer.
The transfer happened right after the swap, suggesting the transaction was noticed and acted on during the block-building process. The ETH appears to have been captured before the attacker could move it further, a pattern that has become increasingly common in large on-chain exploits involving MEV infrastructure.
It remains unclear if the stolen funds belonged to user liquidity providers or the protocol treasury. Users are advised to revoke token approvals for Makina contracts immediately via tools like Revoke.cash.
The funds came from Wrapped Ether and were sent in a single transaction, with no sign of splitting or delay.
So far, there has been no further movement of the stolen funds held in the two wallets. The funds have not been bridged, mixed, or sent to any exchanges, and there is no sign of attempts to hide them.
Makina Finance is yet to respond
Makina Finance has not made any public statement about the exploit. The team has not acknowledged it on social media or clarified whether user funds were affected or if any recovery actions are being taken.
The silence has drawn attention because of the size of the loss and how quickly the attack happened.
This is a developing story.
Also Read: Truebit Exploit Drains $26M in ETH as Hacks Pile Up
