MakerDAO Governance Delegate Loses $11M in Phishing Attack

A MakerDAO governance delegate has fallen prey to a sophisticated phishing attack, resulting in the theft of $11 million worth of Aave Ethereum Maker (aEthMKR) and Pendle USDe tokens.

A MakerDAO governance delegate has fallen prey to a phishing attack, leading to the theft of $11 million in Aave Ethereum Maker (aEthMKR) and Pendle USDe tokens.

The compromised assets were swiftly transferred from the delegate's address, 0xfb94d3404c1d3d9d6f08f79e58041d5ea95accfa, to the scammer's address, 0x739772254924a57428272f429bd55f30eb36bb96, with the transaction confirmed in merely 11 seconds. This governance delegate played a crucial role in MakerDAO, a decentralized finance (DeFi) platform, impacting significant decision-making processes.

Within MakerDAO, governance delegates hold great responsibility, participating in voting on various proposals that influence the protocol's development and operations. They engage in polls and executive votes that ultimately decide the implementation of new measures into the Maker protocol. Typically, MakerDAO tokenholders and delegates advance proposals from initial polls to final executive votes, followed by a security waiting period known as the Governance Security Module (GSM) to ensure stability and prevent abrupt changes.

Rising Threat of Phishing Scams

In recent news, Cointelegraph reported on the increasing prevalence of approval phishing tactics employed by scammers. These scams aim to trick users into authorizing transactions that grant attackers access to their wallets, enabling them to pilfer funds. According to Chainalysis, such methods, often utilized by “pig-butchering” scammers, are on the rise.

Phishing scams involve deceivers posing as trustworthy entities to extract sensitive information from victims. In this case, the governance delegate was deceived into signing multiple phishing signatures, which ultimately facilitated the asset theft.

Earlier in 2024, Scam Sniffer reported that phishing scams resulted in the loss of $300 million from 320,000 users in 2023 alone. One of the most severe incidents documented involved a single victim losing $24.05 million due to various phishing techniques, including permit, permit 2, approve, and increase allowance.