# Euler Finance exploit (March 2023): Euler Finance hit by ~$197M flash-loan exploit on Ethereum in March 2023; nearly all recoverable funds returned by April Source page: https://vaultx.llc/hacks/euler-finance-exploit-2023 · VaultX incident report by Sentinel · first published 2026-10-31, updated 2026-10-31 - Date: 2023-03-13 - Reported loss: $197M (Initially reported at about $197M (Bloomberg); other reports say 'nearly $200M', $199M, or 'over $195M'. Euler later called it a '$240M Exploit' in its post-mortem. Most funds were returned, so the net loss was far lower. Figures are reported, not independently audited.) - Attribution: Unknown. Activity was tied on-chain to 'Euler Exploiter' addresses, not to a named individual, according to the research. Chainalysis reportedly identified a front-running MEV bot and the attacker's primary wallet. A CoinDesk URL slug refers to North Koreans attempting to phish the exploiter, but the research does not confirm this. - Chains: Ethereum - Status: resolved - Severity: 50/100 - Response score: 50/100 On 13 March 2023, lending protocol Euler Finance on Ethereum was exploited for a reported ~$197M, according to Bloomberg and other outlets. The attacker reportedly used a flash loan and a missing health check in the donateToReserves() path to make an account appear insolvent and extract collateral through liquidation. Euler paused the affected modules, offered a $1M reward, and negotiated on-chain with the exploiter, who reportedly began returning funds in late March. Euler announced in early April 2023 that all recoverable funds had been returned. **What happened** According to Bloomberg, Euler Finance was hit by a roughly $197M exploit on 13 March 2023, with the bulk of the loot reported as about $135M in staked Ether (stETH), plus wrapped Bitcoin and stablecoins. Other outlets reported 'nearly $200 million'. Euler said it was working with security professionals and law enforcement and disabled the vulnerable EToken module, which stopped deposits and the donation function. According to the research, the vulnerability had been on-chain for about eight months before it was used, and it existed in multiple pools. On 15 March 2023, Euler announced a $1M reward for information leading to the attackers' arrest and the return of funds. It also negotiated directly with the exploiter on-chain. Developers reportedly told the attacker 'the simplest way out here is to return funds' and warned them not to enter private keys anywhere. The attacker reportedly replied that they wanted to make things easy for those affected and had no intention of keeping what was not theirs. On 25 March 2023, about 51,000 ETH (reported near $90M) was sent back. By 1 April, the research reports about $177M had been returned. On 3-4 April 2023, Euler announced that all recoverable funds had been returned and said it would restore user deposits. **How it worked** According to the research, the attacker took a flash loan to open a large leveraged position. They deposited assets into Euler, received eTokens, and used Euler's borrow and leverage functions to mint very large positions. The core failure was in donateToReserves(). Per the research, a missing health/liquidity check let the attacker call it in a way that worsened the account's health factor without clearing the corresponding debt. This triggered self-liquidation, and the attacker withdrew the collateral captured through liquidation, leaving debt accounting inconsistent. Several analyses reportedly describe this as a root-cause bug in the protocol's solvency and liquidation logic. The research does not provide a verified transaction-level trace, so the step sequence should be treated as a commonly cited reconstruction. **Where the money went** Reported, not confirmed: about 1,000 ETH (~$1.65M) was reportedly sent to Tornado Cash via an intermediary address. Funds were reportedly frozen or affected across 11 DeFi protocols, including Balancer, Yearn.finance and Yield Protocol, but the research has no authoritative frozen-by-protocol ledger. Most funds were returned to Euler's deployer/treasury in tranches. Coinbase's breakdown, as cited in the research, reports 95,532.2 ETH and 43,149,861 DAI returned. The research found no reliable source documenting a major exchange cash-out before recovery. **The response** Euler paused the affected modules and disclosed the incident the same day. It said it was working with security professionals and law enforcement. It posted a $1M reward within two days and negotiated directly with the exploiter on-chain. It reported that most funds were returned between late March and early April and announced that all recoverable funds had been returned. The research describes the Foundation's plan to restore user deposits but gives no payout schedule. It also mentions an offer letting the hacker keep $20M in exchange for returning funds (Cointelegraph URL slug). **Impact** Reported as the largest hack in its segment that year (Bloomberg). Per the research, the exploit hit multiple Euler pools and affected several other DeFi protocols with frozen or lost funds. The research gives no verified post-hack price data for EUL or other tokens. Net user loss is described as substantially reduced by returns, and the research says Euler planned to restore user deposits, but the mechanics are not documented in the sources provided. **Wallets linked to this case** - 0xb2698c2d99ad2c302a95a8db26b08d17a77cedd4 (Ethereum, exploiter (most-cited attacker wallet)) source: https://cointelegraph.com/magazine/euler-finance-attack-how-it-happened-and-what-can-be-learned - 0xb66cd966670d962c227b3eaba30a872dbfb995db (Ethereum, exploiter (Exploiter address 1 per Coinbase)) source: https://www.coinbase.com/blog/euler-compromise-investigation-part-2-the-redemption - 0xebc29199c817dc47ba12e3f86102564d640cbf99 (Ethereum, exploiter (contract address, most-cited attacker set)) source: https://cointelegraph.com/magazine/euler-finance-attack-how-it-happened-and-what-can-be-learned - 0xc66dfa84bc1b93df194bd964a41282da65d73c9a (Ethereum, exploiter (Exploiter address 2 per Coinbase)) source: https://www.coinbase.com/blog/euler-compromise-investigation-part-2-the-redemption - 0xcAD001c30E96765aC90307669d578219D4fb1DCe (Ethereum, recipient (treasury return destination per Euler)) source: https://www.euler.finance/blog/war-peace-behind-the-scenes-of-eulers-240m-exploit-recovery **Timeline** - 2023-03-13 Exploit occurs and is first reported at about $197M. Euler pauses the affected modules and says it is working with security professionals and law enforcement. - 2023-03-15 Euler announces a $1M reward for information on the attackers if most funds are not returned. - 2023-03-21 On-chain messages between Euler developers and the exploiter begin, including the 'return funds' request and the attacker's reply that they want to make things easy for those affected. - 2023-03-25 About 51,000 ETH (reported near $90M) is returned to the protocol. - 2023-03-28 Per CoinDesk (headline), the hacker apologizes and returns millions in ETH and DAI to the protocol. - 2023-04-01 According to the research, about $177M had been returned by this date. - 2023-04-03 Euler says all recoverable funds have been returned (CoinDesk dated 3 April). The research cites Euler's announcement on 4 April, and says the Euler Foundation would unveil a plan to restore user deposits. **Sources** - euler.finance https://www.euler.finance/blog/war-peace-behind-the-scenes-of-eulers-240m-exploit-recovery - certik.com https://www.certik.com/blog/euler-finance-incident-analysis - blocksec.com https://blocksec.com/blog/euler-finance-incident-the-largest-hack-of-2023 - bloomberg.com https://www.bloomberg.com/news/articles/2023-03-13/defi-s-euler-finance-hit-by-197-million-hack-experts-say - blocksec.com https://blocksec.com/es/blog/defi-exploit-analysis-root-cause-euler-s-200m - x.com https://x.com/eulerfinance/status/1635431989061795840 - cointelegraph.com https://cointelegraph.com/news/euler-finance-blocks-vulnerable-module-working-on-recovering-funds - coindesk.com https://www.coindesk.com/tech/2023/03/25/euler-finance-hacker-sends-51000-ether-back-to-protocol --- VaultX: free crypto news and intelligence, https://vaultx.llc