USDS

DeFi

Carry

Maker

<p><strong>A widely circulated claim that Maker lost $1.5 billion has no verified primary source linking that figure to the MakerDAO or Sky Lending protocol; the documented incident of comparable magnitude was a separate exchange security breach at Bitget, which confirmed unauthorized transfers of approximately $388 million from its hot and warm wallet infrastructure on September 24, 2026, according to Bitget's own incident explainer. For DeFi users, the conflation of two distinct entities illustrates a recurring and costly information hazard: in fast-moving security events, incorrect attribution spreads as quickly as accurate reporting, and the downstream consequences for token prices, vault positions, and redemption queues can be severe before corrections surface.</strong></p>
<h2 id="what-the-evidence-actually-shows-bitget-not-maker">What the Evidence Actually Shows: Bitget, Not Maker</h2>
<p>Bitget's first-party incident explainer, published after the breach, states that unauthorized transfers occurred on September 24, 2026, originating from part of its hot and warm wallet infrastructure. The exchange put the final verified amount affected at approximately $388 million, a figure materially different from the $1.5 billion figure in wide circulation. For related coverage, see <a href="https://www.coincu.com/ust-regulatory-pressure-5-billion-action/" rel="noopener noreferrer nofollow">UST Under Regulatory Pressure: What the $5B Action Means</a>.</p>
<figure style="margin:24px 0;padding:22px 24px;border:1px solid #d9dee7;border-left:5px solid #2563eb;border-radius:8px;background:#f8fafc;color:#172033;font-family:Arial,sans-serif">
 <div style="font-size:13px;font-weight:700;letter-spacing:0.08em;text-transform:uppercase;color:#475569;margin-bottom:8px">
  Verified incident amount
 </div>
 <div style="font-size:38px;line-height:1.1;font-weight:800;margin-bottom:10px">
  ≈ $388M
 </div>
 <figcaption style="font-size:14px;line-height:1.5;color:#475569">
  Bitget's final verified figure for its own incident; the supplied evidence does not substantiate a $1.5 billion Maker/Sky loss.
 </figcaption>
</figure>
<p>A separate <a href="https://www.bitget.com/support/articles/12560603896108" rel="noopener noreferrer nofollow">Bitget status update</a> refines the figure to $387.5 million transferred to attacker-controlled addresses and states the incident is contained, with no further unauthorized outflows recorded at the time of publication. Independent investigative outlet Rekt News corroborated the Bitget entity and the roughly $387.5 million scale in its own coverage of the event. Context on this theme: <a href="https://www.coincu.com/defi-a-promising-piece-p1/" rel="noopener noreferrer nofollow">DeFi - A Promising Piece Of The Crypto Market</a>.</p>
<p>No primary announcement from MakerDAO, its successor protocol Sky Lending, or any credible secondary source was found documenting a $1.5 billion exploit against the Maker protocol. The Sky governance forum at <a href="https://forum.sky.money/" rel="noopener noreferrer nofollow">forum.sky.money</a> describes its Legacy section as housing "Sky (formerly Maker)" categories, confirming the rebranding but containing no incident disclosures matching the circulating claim. The absence of a governance emergency proposal, a post-mortem, or a collateral shortfall announcement in the Sky forum is a meaningful signal given that Maker-scale events have historically generated rapid on-chain governance responses within hours.</p>
<h2 id="sky-lending-s-protocol-status-what-on-chain-data-shows">Sky Lending's Protocol Status: What On-Chain Data Shows</h2>
<p>Sky Lending, the protocol previously known as MakerDAO, currently holds roughly <a href="https://defillama.com/protocol/sky" rel="noopener noreferrer nofollow">$5.01 billion in total value locked</a> per DefiLlama's most recent observation, based on the protocol's totalLiquidityUSD figure of $5,014,093,283 returned by DefiLlama's MakerDAO endpoint. A genuine $1.5 billion loss event would represent roughly 30 percent of that figure and would be expected to generate immediate governance action, collateral parameter changes, and a measurable TVL drawdown visible on-chain.</p>
<figure style="margin:24px 0;padding:22px 24px;border:1px solid #d9dee7;border-left:5px solid #0f766e;border-radius:8px;background:#f8fafc;color:#172033;font-family:Arial,sans-serif">
 <div style="font-size:13px;font-weight:700;letter-spacing:0.08em;text-transform:uppercase;color:#475569;margin-bottom:8px">
  Sky Lending total value locked
 </div>
 <div style="font-size:38px;line-height:1.1;font-weight:800;margin-bottom:10px">
  $5.01B
 </div>
 <figcaption style="font-size:14px;line-height:1.5;color:#475569">
  Latest collected TVL context for Sky Lending, the protocol previously known as MakerDAO.
 </figcaption>
</figure>
<p>MKR, the governance token for the Sky ecosystem, was trading at <a href="https://www.coingecko.com/" rel="noopener noreferrer nofollow">$1,568.67 with a 24-hour gain of approximately 1.34 percent</a> at collection time, per CoinGecko. A token price modestly positive on the day is inconsistent with the market response typically triggered by a confirmed nine-figure protocol exploit, as seen in prior events such as the <a href="https://www.coincu.com/how-curve-lost-351-6-million-defi-users/" rel="noopener noreferrer nofollow">Curve Finance incident where token values dropped sharply within hours of confirmed losses</a>.</p>
<h2 id="why-attribution-errors-carry-real-financial-risk-for-defi-users">Why Attribution Errors Carry Real Financial Risk for DeFi Users</h2>
<p>The mechanics of misattribution in DeFi security events follow a consistent pattern. An incident of genuine scale, in this case Bitget's confirmed $387.5 million breach, generates social amplification that outpaces verification. Downstream accounts substitute proximate but incorrect entities, often because the real target is less well-known in a given audience segment, or because partial information is copied without the entity name being checked against primary sources.</p>
<p>For users with active positions in the Sky Lending ecosystem, acting on an unverified Maker exploit claim carries concrete risks: unnecessary vault closures trigger liquidation fees, premature DAI or USDS redemptions can lock users into worse execution prices, and panic sales of MKR on rumors that prove false result in realized losses with no corresponding protocol event to justify them. The Crypto Fear and Greed Index stood at <a href="https://alternative.me/crypto/fear-and-greed-index/" rel="noopener noreferrer nofollow">30 (Fear)</a> at the time of this report's collection, a backdrop that makes retail participants more susceptible to acting on unconfirmed security claims before primary sources are consulted.</p>
<p>The Bitget incident itself provides a concrete reference point for how a verified exchange-level security event differs in character from a protocol-level DeFi exploit. In the Bitget case, the losses were borne within the exchange's own custody infrastructure, meaning user funds held in Bitget wallets faced direct exposure, while DeFi users with no Bitget account had no on-chain exposure to the event. Conflating that with a hypothetical Maker protocol exploit, which would affect vault collateral ratios, DAI peg stability, and MKR governance token value through a fundamentally different mechanism, leads to entirely different risk assessments and user actions. This type of entity confusion is similar to dynamics seen in the <a href="https://www.coincu.com/bitget-352-million-loss-defi-users/" rel="noopener noreferrer nofollow">Bitget $352 million loss coverage</a> where DeFi users were unclear about their direct exposure.</p>
<h2 id="what-confirmed-facts-the-bitget-incident-does-establish">What Confirmed Facts the Bitget Incident Does Establish</h2>
<p>Setting aside the misattribution, the Bitget breach does supply verified data points that matter to exchange users. According to Bitget's first-party explainer, unauthorized transfers from hot and warm wallet infrastructure occurred on September 24, 2026, with a final verified total of approximately $388 million. The exchange's subsequent status update confirmed $387.5 million was transferred to attacker-controlled addresses and stated containment, with no further unauthorized outflows. Exchange-level hot wallet compromises of this magnitude rank among the largest verified CEX security incidents on record.</p>
<p>For users holding assets on centralized exchanges more broadly, the incident reinforces the on-chain security argument that has circulated in DeFi since the early exchange hacks: self-custody removes counterparty risk, while exchange custody concentrates it. That argument is not new, but a confirmed $387.5 million single-exchange breach, per Bitget's own statements, refreshes the data supporting it. DeFi protocols with audited smart contracts and transparent on-chain state offer a distinct and verifiable risk profile compared to opaque exchange hot wallet infrastructure, even as smart contract vulnerabilities represent their own category of risk, as documented in events like the <a href="https://www.coincu.com/solana-amm-aquifer-attack-2-5-million-lost/" rel="noopener noreferrer nofollow">Solana AMM Aquifer attack</a>.</p>
<h2 id="what-defi-users-should-verify-before-acting-on-security-claims">What DeFi Users Should Verify Before Acting on Security Claims</h2>
<p>The standard verification sequence for a security claim of this scale involves four steps: locate a primary-source governance post or official incident announcement from the named protocol; check the protocol's TVL on DeFiLlama for an acute drawdown consistent with the stated loss amount; check the governance token's price action for an anomalous move that would be consistent with a protocol-level event; and search block explorers for large outflows from known protocol treasury or vault addresses. For the circulating Maker/$1.5 billion claim, none of those four signals are present in the evidence collected as of this writing.</p>
<p>Users with active Sky Lending positions should monitor the Sky governance forum at forum.sky.money for any emergency governance proposals, risk parameter changes, or official incident disclosures. The absence of an emergency proposal on the forum is not a guarantee that no event has occurred, but it is a necessary first check before repositioning. If a genuine protocol event were to emerge, the governance forum would be the authoritative primary source, not social media amplification of an unverified secondary claim.</p>
<h2 id="faq-the-maker-1-5-billion-claim">FAQ: The Maker $1.5 Billion Claim</h2>
<h3 id="did-maker-really-lose-1-5-billion">Did Maker really lose $1.5 billion?</h3>
<p>As of this report's collection date, no primary source, on-chain evidence, or credible secondary reporting confirms that MakerDAO or Sky Lending lost $1.5 billion. No governance emergency proposal, post-mortem, or treasury shortfall announcement was found on the Sky forum. The claim is unverified, and no corroborating data from TVL metrics, token price action, or block explorer records supports it at this time.</p>
<h3 id="what-incident-does-the-evidence-actually-document">What incident does the evidence actually document?</h3>
<p>The verified incident is a security breach at Bitget, a centralized exchange, not a DeFi lending protocol. According to Bitget's own account, unauthorized transfers from its hot and warm wallet infrastructure occurred on September 24, 2026, with a final verified amount of approximately $388 million transferred to attacker-controlled addresses. Bitget and MakerDAO or Sky Lending are distinct entities with no operational overlap in the collected evidence.</p>
<h3 id="are-maker-or-sky-lending-users-funds-affected">Are Maker or Sky Lending users' funds affected?</h3>
<p>No verified evidence of a Maker or Sky Lending exploit was found. Sky Lending's TVL remained at approximately $5.01 billion per DefiLlama's most recent observation, and MKR showed a modest positive 24-hour price change of approximately 1.34 percent at collection time, per CoinGecko. Users with positions in Sky Lending vaults should consult the Sky governance forum directly for any official protocol announcements rather than relying on unverified secondary claims.</p>
<h3 id="what-should-defi-users-monitor-now">What should DeFi users monitor now?</h3>
<p>Users with Bitget account balances should consult Bitget's official support channels and the Bitget incident status update for the current containment status and any compensation or withdrawal guidance. Users with Sky Lending or MakerDAO positions should monitor the Sky governance forum for any new proposals or emergency actions. No on-chain evidence warranting emergency repositioning for Maker protocol users has been established in the evidence underlying this report.</p>
<p style="font-size:13px;color:#888;border-top:1px solid #333;padding-top:12px;margin-top:30px">Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.</p>
<p>The post <a href="https://www.coincu.com/maker-lost-1-5-billion-defi-user-impact/" rel="noopener noreferrer nofollow">How Maker Lost $1.5B: What It Means for DeFi Users</a> was initially published on <a href="https://coincu.com/" rel="noopener noreferrer nofollow">Coincu</a>.</p>

How Maker Lost $1.5B: What It Means for DeFi Users

Table of Contents

Coincu

Other articles published on Oct 31, 2026

Join our free newsletter for daily crypto updates!