On 13 March 2023, lending protocol Euler Finance on Ethereum was exploited for a reported ~$197M, according to Bloomberg and other outlets. The attacker reportedly used a flash loan and a missing health check in the donateToReserves() path to make an account appear insolvent and extract collateral through liquidation. Euler paused the affected modules, offered a $1M reward, and negotiated on-chain with the exploiter, who reportedly began returning funds in late March. Euler announced in early April 2023 that all recoverable funds had been returned.
We message you the minute a major hack, exploit or fraud is confirmed, with the amount lost and what to do. Free, no spam, stop any time.
According to Bloomberg, Euler Finance was hit by a roughly $197M exploit on 13 March 2023, with the bulk of the loot reported as about $135M in staked Ether (stETH), plus wrapped Bitcoin and stablecoins. Other outlets reported 'nearly $200 million'.
Euler said it was working with security professionals and law enforcement and disabled the vulnerable EToken module, which stopped deposits and the donation function. According to the research, the vulnerability had been on-chain for about eight months before it was used, and it existed in multiple pools.
On 15 March 2023, Euler announced a $1M reward for information leading to the attackers' arrest and the return of funds. It also negotiated directly with the exploiter on-chain. Developers reportedly told the attacker 'the simplest way out here is to return funds' and warned them not to enter private keys anywhere.
The attacker reportedly replied that they wanted to make things easy for those affected and had no intention of keeping what was not theirs. On 25 March 2023, about 51,000 ETH (reported near $90M) was sent back. By 1 April, the research reports about $177M had been returned. On 3-4 April 2023, Euler announced that all recoverable funds had been returned and said it would restore user deposits.
According to the research, the attacker took a flash loan to open a large leveraged position. They deposited assets into Euler, received eTokens, and used Euler's borrow and leverage functions to mint very large positions.
The core failure was in donateToReserves(). Per the research, a missing health/liquidity check let the attacker call it in a way that worsened the account's health factor without clearing the corresponding debt. This triggered self-liquidation, and the attacker withdrew the collateral captured through liquidation, leaving debt accounting inconsistent.
Several analyses reportedly describe this as a root-cause bug in the protocol's solvency and liquidation logic. The research does not provide a verified transaction-level trace, so the step sequence should be treated as a commonly cited reconstruction.
Reported, not confirmed: about 1,000 ETH (~$1.65M) was reportedly sent to Tornado Cash via an intermediary address. Funds were reportedly frozen or affected across 11 DeFi protocols, including Balancer, Yearn.finance and Yield Protocol, but the research has no authoritative frozen-by-protocol ledger. Most funds were returned to Euler's deployer/treasury in tranches. Coinbase's breakdown, as cited in the research, reports 95,532.2 ETH and 43,149,861 DAI returned. The research found no reliable source documenting a major exchange cash-out before recovery.
| Address | Chain | Role | Source |
|---|---|---|---|
0xb2698c2d99ad2c302a95a8db26b08d17a77cedd4 | Ethereum | exploiter (most-cited attacker wallet) | source |
0xb66cd966670d962c227b3eaba30a872dbfb995db | Ethereum | exploiter (Exploiter address 1 per Coinbase) | source |
0xebc29199c817dc47ba12e3f86102564d640cbf99 | Ethereum | exploiter (contract address, most-cited attacker set) | source |
0xc66dfa84bc1b93df194bd964a41282da65d73c9a | Ethereum | exploiter (Exploiter address 2 per Coinbase) | source |
0xcAD001c30E96765aC90307669d578219D4fb1DCe | Ethereum | recipient (treasury return destination per Euler) | source |
Every address is from a public source. Check any wallet in the dirty wallet checker.
Euler paused the affected modules and disclosed the incident the same day. It said it was working with security professionals and law enforcement. It posted a $1M reward within two days and negotiated directly with the exploiter on-chain. It reported that most funds were returned between late March and early April and announced that all recoverable funds had been returned. The research describes the Foundation's plan to restore user deposits but gives no payout schedule. It also mentions an offer letting the hacker keep $20M in exchange for returning funds (Cointelegraph URL slug).
Reported as the largest hack in its segment that year (Bloomberg). Per the research, the exploit hit multiple Euler pools and affected several other DeFi protocols with frozen or lost funds. The research gives no verified post-hack price data for EUL or other tokens. Net user loss is described as substantially reduced by returns, and the research says Euler planned to restore user deposits, but the mechanics are not documented in the sources provided.
45% negative · 20% positive · the rest neutral · themes: flash loan exploit, DeFi lending risk, negotiated fund return, $1M bounty, on-chain negotiation with attacker, protocol restoration of deposits
How we report: Sentinel reads news, investigators' posts, company statements and on-chain data, attributes every claim to its source and marks unconfirmed numbers as reported. Severity measures size and systemic risk; the response score measures how fast and transparently users were protected. Not financial advice and not a finding of guilt. Corrections: contact us.
New exploit reports, major incidents and security updates from VaultX. Free. You choose below; nothing starts until you opt in.
On Telegram, press Start in the bot to subscribe. New reports are also posted on our alerts channel. Not financial advice.
VaultX