Black Thursday revisited: MakerDAO keeper exploited for $500K

What it is

A legacy MakerDAO auction-keeper contract was exploited for over $500,000. The vulnerability traces back to Black Thursday (March 2020), when four 50-ETH lots from the liquidation crisis were won via "zero bids" but never settled. The exploited keeper implementation is at address 0x68399ed8aa33C5b43F863EE6782de492006A5546. The analysis comes from CertiK.

How it works

CertiK identified the root cause as a missing access control on function 0x8804d1de in the keeper implementation. This let an attacker call the function without authorization and remove 200 ETH (the four unsettled 50-ETH lots left over from Black Thursday) directly from the contract. The attacker then laundered the funds by sending them through Tornado Cash in 10-ETH increments.

flowchart TD
    A[Black Thursday 2020:<br/>4x 50-ETH lots won via zero bids] --> B[Lots never settled,<br/>ETH remains in contract]
    B --> C[2026: Attacker calls function 0x8804d1de]
    C --> D{Access control check}
    D -->|Missing - exploit path| E[200 ETH drained]
    E --> F[Laundered via Tornado Cash<br/>in 10-ETH lots]

Preconditions / Affected

• Only affects the specific legacy auction-keeper contract (0x68399ed8aa33C5b43F863EE6782de492006A5546) holding leftover Black Thursday funds — not the current Sky (formerly MakerDAO) ecosystem.
• Requires the contract to still hold unclaimed/unsettled ETH from the 2020 incident, and the vulnerable function to lack access control.

What to do

The page does not state a remediation, patch, or recovery action — it is reported as a post-hoc forensic analysis by CertiK of funds already stolen and laundered.

Caveats

The page explicitly notes this contract "wasn't a core part of the current Sky ecosystem." No confirmation of attacker identity or possibility of fund recovery is given; the framing is that old, inactive contracts holding real value remain exploitable targets years later.