A contract nobody remembered. Four auction lots nobody settled. Five years of dead silence. Then somebody called function 0x8804d1de and walked off with 200 ETH.
That's roughly $500,000, drained out of a MakerDAO auction keeper the protocol quietly abandoned somewhere around 2020. No flash loan. No reentrancy circus. No governance coup. Just a function that forgot to ask who was knocking. t check — that's the entire hack.
I've been staring at address 0x68399ed8aa33C5b43F863EE6782de492006A5546 for most of a day now, and the thing that keeps bugging me isn't the money. It's the silence. A live contract, still holding ETH, untouched for half a decade, and nobody at MakerDAO or Sky ever thought to sweep the drawer. Pump, dump, debug. Repeat.
Here's the part the headlines buried. This wasn't a bug. It was a fossil.
Go back to March 12, 2020. Black Thursday. ETH got cut roughly in half in a single session, and every liquidation engine in DeFi screamed at once. MakerDAO's auction system was built for a calmer chain — one where keepers could actually submit bids. Instead, gas spiked into the hundreds of gwei, transactions sat in the mempool, and the auctions kept clearing anyway. Some keepers won collateral lots at literally zero DAI because no competing bid ever landed. Millions in bad debt followed. The protocol survived, but it spent the next year rebuilding its liquidation stack — DSS, new auction parameters, the whole overhaul.
And in the wreckage of that rebuild, four 50 ETH lots got won at zero bids and never settled. The auction confirmed. The asset transfer never completed. Those 200 ETH stayed parked inside the old keeper implementation, waiting. For five years.
So when a CertiK write-up landed describing an "access control vulnerability," I didn't need the report to know what I was looking at. SWC-105. The oldest, dumbest bug in the book. A function with no onlyOwner, no require, no guardrail of any kind — callable by literally anyone with a wallet and a block explorer.
Based on my own contract-audit work going back to the 2017 ICO sprint, I can tell you exactly how this got found. Nobody brute-forced anything clever. An attacker — or more likely a bot — scans for contracts that hold an ETH balance but show zero recent interaction. Then it tries calling unprotected function selectors one by one. 0x8804d1de is almost certainly a withdraw, settle, or claim-style function that should have been gated behind the auction system or an owner. It wasn't. The attacker called it, pulled the 200 ETH of residual auction collateral, and split the proceeds into Tornado Cash in clean 10 ETH tranches.
Ten ETH per deposit. That's a mixing pattern, not a panic move. Somebody who knew exactly what they were doing and wanted the trail cold before anyone noticed the contract was bleeding.
The financial damage is noise. Against a protocol running tens of billions in FDV, $500K of orphaned auction dust is a rounding error. Sky's core minting, liquidations, and stablecoin operations were never touched — this keeper has been outside the live system for years. If you were hoping for a price catalyst on MKR or SKY, look elsewhere. This event is worth roughly 0% of your portfolio and 100% of your attention.
Now the angle nobody's running with. This isn't a MakerDAO story. It's a DeFi story wearing a MakerDAO costume.
Every protocol that has ever shipped a v2 has a graveyard behind it. Old vaults. Deprecated routers. Abandoned keepers. Migrated bridges. And here's the uncomfortable truth about that graveyard: as long as a contract holds value, it stays on the attack surface — forever. Deprecation isn't a security control. It's a vibe. The chain doesn't care that your team moved on. The chain only cares whether the ETH is still sitting there.
The MakerDAO exploit isn't remarkable because of the technique. It's remarkable because it proves the thesis. Four zero-bid lots, forgotten by everyone including the people who built them, still worth real money five years later, still callable by a stranger. The bug was old. The exposure was older. And nobody swept it.
This is a DAO governance failure more than a code failure. When a protocol migrates, someone has to answer a boring question: did we drain the old contracts and lock the old permissions? In a decentralized org, that task has no owner. It's unglamorous, it never makes a proposal, and it never wins a vote. So it never happens. Gas fees higher than the yield on caring. Typical.
Which brings me to the copycat math. The attack cost almost nothing. Scan, probe, withdraw. That playbook is scriptable, and it's already been scripted. I'd bet real money there are dozens of zombie contracts across DeFi right now holding stray ETH behind unprotected functions, each one a lottery ticket waiting for the right bot to roll up.
Here's my read for the next few months. Watch the Sky governance forums — if anything forces a proposal, it'll be a "legacy contract asset sweep" motion, and I'd expect voter turnout to be embarrassingly low because nobody gets excited about janitorial work. Watch for the second attack. The first one teaches; the second one confirms a pattern. And watch the Tornado Cash trail — those ten-ETH deposits are now flagged addresses, which means the attacker's exit is a one-way door into a compliance black hole. The money's gone. The lesson isn't.
So the next time a protocol proudly announces its shiny new migration, ask the only question that matters: who drained the old one? If the answer is "nobody," you're not looking at a sunset. You're looking at a loaded gun with a timer.
