KEYTAKEAWAYS
- The $4.2 million DUSD exploit was a precision flash loan attack that manipulated short-term pricing assumptions, draining a single Curve pool without compromising the broader stablecoin system.
- The incident highlights a recurring DeFi vulnerability where deep liquidity and oracle dependencies can become liabilities under extreme, short-lived capital imbalances.
- While Makina’s rapid containment limited contagion, the event reinforces that LP risk in stablecoin pools is structurally different from simple token-holding risk.
CONTENT
A targeted flash loan attack on Makina’s DUSD/USDC Curve pool shows how stablecoin liquidity, oracle design, and flash liquidity can combine to create concentrated risk for LPs.
THE INCIDENT
In the early hours of January 20, a highly targeted flash loan attack drained roughly $4.2 million from the DUSD/USDC liquidity pool on Curve, marking one of the most technically precise stablecoin exploits of early 2026 and underscoring how composability, while powerful, continues to create attack surfaces when oracle dependencies and liquidity assumptions align imperfectly.
DUSD, a multi-chain stablecoin issued by Makina Finance, was not attacked through its core mint–redeem mechanism but through a single liquidity venue, where an attacker borrowed approximately $280 million in USDC via flash loans, temporarily distorted oracle-referenced pricing inputs, inflated the apparent value of a liquidity position, and extracted the pool’s available assets before the system could re-equilibrate, ultimately walking away with funds equivalent to around 1,299 ETH at the time of the exploit.
Crucially, the incident did not compromise the broader DUSD supply or users simply holding DUSD, Pendle positions, or Gearbox exposure, a distinction that Makina emphasized in post-incident communications, yet the speed and precision of the drain made it clear that even well-isolated pools can become single points of failure when capital concentration, oracle latency, and flash liquidity intersect.
HOW THE ATTACK WORKED
At a technical level, the exploit followed a pattern increasingly familiar to DeFi security researchers, but with execution refined to a narrow target: by injecting an enormous, short-lived amount of USDC into the DUSD/USDC Curve pool, the attacker was able to manipulate pricing assumptions relied upon by downstream logic, creating the illusion of excess liquidity and enabling profitable arbitrage within a single transaction bundle.
Because flash loans require no upfront capital and must be repaid within the same block, the attacker bore minimal directional risk, instead exploiting temporal price distortion, a class of vulnerability that has repeatedly surfaced across DeFi when pools depend on price feeds that can be skewed by short-term imbalances rather than time-weighted or multi-source aggregation.
The result was not a systemic collapse but a clean extraction: approximately $5.1 million in USDC equivalent, as later disclosed by Makina, was siphoned from the pool, leaving liquidity providers fully exposed while the broader protocol infrastructure remained intact.
CONTAINMENT AND RESPONSE
Makina’s response was notable for its speed and scope, reflecting lessons learned from earlier DeFi crises: the team immediately confirmed that the exploit was isolated to the Curve DUSD/USDC pool, performed a pre-attack snapshot of liquidity provider balances, and activated a recovery mode that allowed affected LPs to withdraw unilaterally into DUSD while longer-term remediation options were evaluated.
In public statements released on January 21, Makina indicated that it had identified leads related to the attacker’s on-chain identity and was actively attempting to engage, while also committing to reopen redemption functionality and provide alternative exit paths for liquidity providers once safeguards were in place, a strategy aimed at preventing panic-driven contagion across other venues.
This approach contrasts sharply with earlier DeFi incidents where delayed communication and unclear scope amplified losses, and it highlights how operational maturity—rather than absolute exploit prevention—has become a key differentiator among protocols managing stablecoin infrastructure.
MARKET SIGNALS AND LIQUIDITY MEMORY
What makes the DUSD episode particularly instructive is the contrast between the exploit and DUSD’s prior liquidity narrative: just months earlier, in September 2025, the DUSD/USDT pair on PancakeSwap had topped the platform’s TVL rankings at $129 million, with $82.11 million in 24-hour volume and $439 million over seven days, positioning DUSD as one of the most actively used stablecoin pairs within certain trading ecosystems.
That historical context matters, because it illustrates how liquidity depth, while often interpreted as a sign of stability, can also become a magnet for precision attacks when capital is sufficiently concentrated and economic incentives align, especially in pools where stablecoin parity is assumed rather than continuously stress-tested.
In this sense, the exploit does not invalidate DUSD as a stablecoin, but it does reinforce a recurring DeFi lesson: liquidity is not synonymous with safety, and the very pools that appear most resilient under normal conditions can become optimal targets under adversarial ones.
A BROADER STABLECOIN LESSON
Beyond the immediate loss, the DUSD flash loan attack speaks to a structural challenge facing on-chain stablecoins as they scale across chains and protocols: while composability enables rapid growth and capital efficiency, it also creates complex dependency graphs in which localized failures can produce disproportionate outcomes for specific user cohorts.
As regulators, institutions, and infrastructure providers increasingly scrutinize stablecoins not just as instruments but as payment and settlement layers, incidents like this sharpen the distinction between protocol solvency and venue-level risk, a nuance often overlooked by users chasing yield in liquidity pools without fully accounting for oracle design, withdrawal mechanics, or adversarial stress scenarios.
The fact that DUSD holders outside the affected pool remained unharmed may ultimately work in Makina’s favor, yet the episode reinforces that the next phase of DeFi stability will depend less on headline TVL figures and more on how protocols architect their weakest links, particularly where flash liquidity and price discovery collide.
Read More：
