Maker DAO Vault Ownership Transfer Whale Phishing

Notice: This page is a freshly imported case study from an original repository. While the original content had a similar format, some sections may not have been fully completed. Please help fill in any empty sections or any missing information you can find. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

Notice: This page contains sources which are not attributed to any text. The unattributed sources follow the initial description. Please assist by visiting each source, reviewing the content, and placing that reference next to any text it can be used to support. Feel free to add any information that you come across which isn't present already. Sources which don't contain any relevant information can be removed. Broken links can be replaced with versions from the Internet Archive. See General Tutorial on Wikis, Anatomy of a Case Study, and/or Citing Your Sources Guide for additional information. Thanks for your help!

Maker DAO Logo/Homepage

MakerDAO is behind the large stablecoin DAI, which is backed by cryptocurrency assets stored in vaults. A large whale and the owner of one of the largest MakerDAO vaults was successfully phished with a transaction that sent ownership of their vault to a new wallet address. Once the ownership had been taken over, the vault was used to mint 55.4M additional DAI, which were then transferred to the attacker. Some of the DAI were converted to Ethereum. There is no word on who the victim was or any plans to investigate or reclaim the funds.

About MakerDAO

"A better, smarter currency. Dai can be used by anyone, anywhere, anytime." "MakerDAO is a decentralized organization dedicated to bringing stability to the cryptocurrency economy. The Maker Protocol employs a two-token system. The first being, Dai, a collateral-backed stablecoin that offers stability. The Maker Foundation and the MakerDAO community believe that a decentralized stablecoin is required to have any business or individual realize the advantages of digital money. Second, there is MKR, a governance token that is used by stakeholders to maintain the system and manage Dai. MKR token holders are the decision-makers of the Maker Protocol, supported by the larger public community and various other external parties."

"The Maker Protocol, also known as the Multi-Collateral Dai (MCD) system, allows users to generate Dai by leveraging collateral assets approved by “Maker Governance.” Maker Governance is the community organized and operated process of managing the various aspects of the Maker Protocol. Dai is a decentralized, unbiased, collateral-backed cryptocurrency soft-pegged to the US Dollar. Resistant to hyperinflation due to its low volatility, Dai offers economic freedom and opportunity to anyone, anywhere."

"Since Maker is decentralized, it can’t use credit scores to verify the creditworthiness of its borrowers. Hence, loans on the platform are overcollateralized, meaning that a borrower supplies more assets that they can take out." "MakerDAO is known as the creator of dai (DAI), the decentralized stablecoin currently beloved by yield farmers. DAI is created with debt. Users put ETH or other crypto-assets up as collateral on the Maker platform to then withdraw a portion of the value of those assets in the form of brand-new DAI." "To get back their collateral, users must repay the DAI they borrowed plus whatever interest the loan has accrued (in MakerDAO parlance this is the “stability fee,” but it’s just a variable interest rate). MakerDAO enforces the DAI price by liquidating collateral if its value falls below the minimum threshold to maintain proper collateralization. For ETH, that’s 150%, but most users put in a lot more ETH than the minimum." "If the collateral value goes below a certain threshold, the loan is marked as undercollateralized, and liquidators can participate in an auction to liquidate the loan for a 13% reward."

The Reality

This sections is included if a case involved deception or information that was unknown at the time. Examples include:

• When the service was actually started (if different than the "official story").
• Who actually ran a service and their own personal history.
• How the service was structured behind the scenes. (For example, there was no "trading bot".)
• Details of what audits reported and how vulnerabilities were missed during auditing.

What Happened

"A few hours ago a victim was drained for 55.4M DAI"

Key Event Timeline - Maker DAO Vault Ownership Transfer Whale Phishing

Date	Event	Description
August 20th, 2024 11:40:47 AM MDT	Ownership Transfered	The ownership of the Maker DAO vault is transfered to the attacker, through tricking the victim into signing an unknown transaction.
August 20th, 2024 5:33:35 PM MDT	Blockchain Transaction	The blockchain transaction is confirmed where 55,473,618.0418 DAI is transfered from the victim to the phisher.
August 20th, 2024 8:50:00 PM MDT	ZachXBT Investigation Shared	ZachXBT shares the transaction with the caption "A few hours ago a victim was drained for 55.4M DAI".
August 20th, 2024 10:39:00 PM MDT	CertiK Investigation Tweet	CertiK shares an investigation/analysis of the attack on Twitter.
August 21st, 2024 1:36:00 AM MDT	Conversion To Ethereum	It is reported that the attacker has converted 27.5M $DAI to 10,625 $ETH.

Technical Details

"Inferno Drainer (Fake_Phishing187019) set the owner address of a Maker vault to 0x5d4b2a02c59197eb2cae95a6df9fe27af60459d4 and minted 55,473,618 Dai tokens (~$55M) to it."

"The theft was possible due to the attacker gaining access to EOA 0xf2B889437F243396b29E829908b5d8ebE2e13048Ttthe wallet was used to transfer ownership of DSProxy #166,776 to 0x0000db5c8B030ae20308ac975898E09741e70000 11 hours ago at Aug-20-2024 05:40:47 PM UTC."

"Jingyi Guo, an analyst at Blocksec, highlighted the likelihood that the victim had signed a phishing transaction, given their failed attempts to invoke the DSProxy after the ownership change."

"Security firm Blocksec confirmed this to The Block, adding that the attacker lured the victim into signing a TX to change the vault owner and then executed a TX to drain the vault. It explained that on-chain data suggested the Maker Vault owner likely assigned ownership of the DSProxy to the address labeled Fake_Phishing187019 on Etherscan during the phishing transaction."

"Subsequently, Fake_Phishing187019 transferred ownership to the address 0x5D4b2, which is now handling further withdrawals and potential money laundering activities, including the withdrawal of the victim’s DAI."

Total Amount Lost

The total amount lost has been estimated at $55,474,000 USD.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

Immediate Reactions

"The victim tried to invoke DSProxy. However, since they were no longer the owner address of DSProxy, the invocation failed. Given this, the likelihood of the victim signing a phishing transaction is higher than the possibility of their private key being compromised," Blocksec analyst Jingyi Guo said.

"The whale, perhaps sensing something was amiss, attempted to withdraw their funds to safer waters."

Ultimate Outcome

"But it was too late, the ownership had already changed and the transaction failed.

A digital fortune had evaporated in the blink of an eye, serving as a very expensive lesson in the dangers lurking in crypto's deep waters."

Total Amount Recovered

There do not appear to have been any funds recovered in this case.

What funds were recovered? What funds were reimbursed for those affected users?

Ongoing Developments

What parts of this case are still remaining to be concluded?

Individual Prevention Policies

No specific policies for individual prevention have yet been identified in this case.

For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.

Platform Prevention Policies

Policies for platforms to take to prevent this situation have not yet been selected in this case.

For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.

Regulatory Prevention Policies

No specific regulatory policies have yet been identified in this case.

For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.