Maya Protocol

Maya

Safe

Blockchain security firm CertiK has flagged an exploit involving a MakerDAO liquidation keeper bot, raising fresh questions about the security of the automated infrastructure that underpins DeFi’s largest lending protocols. No additional incident specifics, loss figures, or resolution details have been confirmed at the time of publication.
<h2 id="what-certik-flagged-about-the-keeper-bot">What CertiK Flagged About the Keeper Bot</h2>
CertiK identified the affected component as a liquidation keeper bot tied to the MakerDAO protocol. Keeper bots are third-party automated programs that monitor collateral positions and trigger liquidations when a vault falls below its required collateral ratio. They are a critical piece of infrastructure, but they operate outside the core smart contracts. For related coverage, see <a href="https://www.theccpress.com/xrp-jay-clayton-ai-czar-reports/" rel="noopener noreferrer nofollow">XRP in Focus: What the Jay Clayton AI Czar Reports Could Mean</a>.
The distinction matters. A compromised keeper bot is not the same as a flaw in MakerDAO’s core protocol code. But it can still create serious operational risk, particularly if bots are manipulated into missing liquidations, executing them at unfavorable prices, or draining funds held within the bot’s own operating wallet.
CertiK has previously warned about the growing threat surface in DeFi automation. As the firm’s CEO has noted, <a href="https://www.theccpress.com/certik-ceo-defi-ai-attacks-unfair-game/" rel="noopener noreferrer nofollow">AI-assisted DeFi attacks represent an increasingly uneven playing field</a> for defenders. Keeper bots, which operate autonomously and often hold gas-funded wallets, are an obvious target.
The MakerDAO team maintains a dedicated security disclosure portal at <a href="https://security.makerdao.com/" rel="noopener noreferrer nofollow">security.makerdao.com</a>, which is the authoritative channel for any official incident update. Readers should monitor that resource directly for confirmed details as they emerge.
<h2 id="why-liquidation-bots-are-a-high-value-target">Why Liquidation Bots Are a High-Value Target</h2>
In MakerDAO’s collateral system, keeper bots compete to liquidate undercollateralized positions and earn a liquidation fee in return. When those bots fail, or are manipulated, vaults can go unliquidated, leaving the protocol exposed to bad debt. The same dynamic played out during past market dislocations, where congested networks and missing keepers caused real losses for the protocol.
Exploiting a keeper bot can take several forms: draining the bot’s ETH or stablecoin operating balance, front-running its liquidation calls, or tricking it into executing a transaction that benefits an attacker rather than the protocol. Which of these vectors, if any, was involved in the CertiK report has not been confirmed.
This type of third-party automation risk is not unique to MakerDAO. A <a href="https://www.theccpress.com/slowmist-flashloopadapter-flaw-safe-wallets-collateral-drain/" rel="noopener noreferrer nofollow">FlashLoopAdapter flaw flagged by SlowMist</a> earlier drained two Safe wallets by exploiting peripheral infrastructure, not core contract logic, in a similar pattern. The attack surface for DeFi increasingly lives in the automation layer, not the protocol itself.
Other protocols have learned this lesson at significant cost. <a href="https://www.theccpress.com/maya-protocol-loses-1-7m-six-bug-exploit-defi-security-gaps/" rel="noopener noreferrer nofollow">Maya Protocol lost $1.7 million across six separate bugs</a>, and <a href="https://www.theccpress.com/thorchain-reportedly-suffers-10-million-exploit-affecting-assets-across-multiple-blockchains/" rel="noopener noreferrer nofollow">THORChain reportedly suffered a $10 million exploit</a> affecting cross-chain assets, both highlighting how interconnected and fragile DeFi infrastructure can be when peripheral components are targeted.
<h2 id="what-to-watch-next">What to Watch Next</h2>
Until CertiK publishes a full post-mortem or MakerDAO’s security team issues an official statement, the scope of this incident remains unverified. No loss figure, affected wallet, or transaction hash has been confirmed in the available evidence.
What is clear is that keeper bots are not a niche concern. They are load-bearing infrastructure. If a liquidation keeper fails during a sharp market move, the protocol’s solvency backstop weakens at precisely the moment it needs to hold. That systemic dependency is why a report of this kind deserves attention even before the full picture is known.
Will this prompt MakerDAO to tighten third-party bot requirements, or will it expose a broader gap in how DeFi protocols audit the automation running around their contracts?
Additional source references: <a href="https://app.sky.money/" rel="noopener noreferrer nofollow">source document 1</a>.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.
The article <a href="https://www.theccpress.com/?p=48906" rel="noopener noreferrer nofollow">CertiK Reports MakerDAO Liquidation Keeper Bot Exploit</a> first featured on <a href="https://theccpress.com/" rel="noopener noreferrer nofollow">theccpress.com</a>.

CertiK Reports MakerDAO Liquidation Keeper Bot Exploit

Table of Contents

Cryptocurrency Press

Other articles published on Oct 7, 2026

Join our free newsletter for daily crypto updates!