Makina Recovers Majority of Funds from Exploit, Whitehat Process Returns 920 ETH

Makina has successfully recovered a significant portion of funds lost during an exploit on January 20, 2026. The project announced the return of approximately 920 ETH, facilitated by the MEV builder through a whitehat process, marking a notable recovery effort within the decentralized finance (DeFi) space.

Key Takeaways

Makina has reclaimed approximately 920 ETH from the January 20 exploit.
The recovered funds were part of the total 1,299 ETH tied to the DUSD/USDC Curve pool incident.
Ongoing efforts are underway to recover an additional 276 ETH linked to the exploit.
The incident was limited to liquidity providers on the USDC side of the Curve pool, with no impact on other assets held within Makina.
DeFi exploits in early 2026 reflect a troubling trend, but the recovery highlights effective whitehat interventions.

Makina recovers majority of funds from exploit as whitehat process returns 920 ETH

920 ETH Returned Through Whitehat Framework

In an announcement made on January 22, Makina revealed that around 920 ETH has been successfully returned by an MEV builder connected to the exploit incident, after deducting a 10% bounty awarded through the SEAL Whitehat Safe Harbor program. This recovered amount constitutes the majority of the 1,023 ETH initially taken by the MEV builder and represents a notable portion of the approximate 1,299 ETH total lost during the DUSD/USDC Curve pool exploit on January 20.

On-chain data indicates that the recovered assets were transferred to a designated recovery multisig wallet, which has been established specifically to oversee the restitution process and outline future actions.

Recovery Efforts Ongoing

Although this recovery represents a significant advancement, Makina has indicated that efforts to secure the remaining funds continue. Approximately 276 ETH associated with the exploit has been directed to an address recognized as a Rocket Pool validator. The Makina team is actively attempting to reach out and has solicited help from the community to identify the individual or entity related to that address.

Makina has assured stakeholders that information regarding methods of distribution and timelines for the returned funds will be communicated as soon as feasible, emphasizing that the recovery process is still in progress.

Overview of the Makina Exploit

As previously mentioned, the exploit primarily affected the USDC side of Makina's DUSD/USDC Curve pool and was confined to liquidity providers only. Other users with DUSD, Pendle, or Gearbox positions, as well as those with assets within Makina's Machines, were not affected. Security measures successfully detected suspicious activity shortly before the exploit occurred, which was ultimately executed by a second address recognized as an MEV bot. The Security Council at Makina activated recovery mode in collaboration with SEAL911 and independent auditors to mitigate further losses.

Trends in Exploits for Early 2026

This recovery does not significantly shift the larger trend observed in the early part of 2026, where a small number of exploitations at the protocol level are responsible for the majority of financial losses. Makina's incident is among the more substantial DeFi exploits reported this year, alongside incidents involving Truebit and YO Protocol. However, the successful partial recovery underscores the increasing importance of whitehat frameworks and coordinated response strategies in minimizing long-term losses from such events.

Final Thoughts

In conclusion, while there is still much work ahead for Makina, the recovery of 920 ETH is a positive step in addressing the losses from the exploit. The ongoing collaboration with whitehat initiatives demonstrates a proactive approach to safeguarding funds and restoring trust within the DeFi ecosystem.