In March 2023, an attacker drained $197 million from Euler Finance in a single, carefully constructed sequence of transactions — making it the largest DeFi hack of the year. Then, two weeks later, something almost unheard of in crypto happened: the hacker sent a message directly on-chain that read, “We want to make this right.” Over the next month, they returned most of what they took. The Euler Finance hack is one of the most studied cases in DeFi security history — not just for the scale of the exploit, but for the strange, unprecedented negotiation that followed.
Here’s what happened, how it worked, and what it means for anyone participating in DeFi today.
What Euler Finance Was
Euler Finance was a lending protocol built on Ethereum, similar to Aave and Compound. If you’re not familiar with DeFi lending, the basic concept is simple: you deposit crypto as collateral, and the protocol lets you borrow other assets against it. Interest accrues on both sides — depositors earn yield, borrowers get liquidity without selling their holdings.
What set Euler apart was its approach to collateral. Where Aave uses a curated list of approved assets — a deliberately conservative set of tokens the team has vetted — Euler allowed users to list almost any ERC-20 token as collateral. (An ERC-20 token is simply any fungible token built to the standard specification on Ethereum.) That flexibility was seen as a competitive advantage: it made Euler attractive to projects that wanted their tokens included in a lending market without going through Aave’s approval process.
At the time of the attack, Euler had approximately $197 million in total value locked (TVL) — meaning that’s how much crypto users had deposited into the protocol. It had been audited multiple times by reputable security firms. In the DeFi world, that track record mattered. It was a signal that the protocol had been examined and found sound.
The Vulnerability: One Missing Safety Check
Every lending protocol lives or dies by a single principle: your collateral must always be worth more than what you’ve borrowed. If the value of your collateral falls below a threshold, the protocol liquidates your position to protect other depositors. This health check — sometimes called a “health factor” — is fundamental to how all DeFi lending works.
Euler had a function called donateToReserves. It was designed to let users voluntarily donate tokens to the protocol’s reserve pool, which functioned as a community insurance fund. A nice feature — a way for community members to contribute to the protocol’s safety buffer.
The problem was subtle: the donateToReserves function did not run the health check. In every other function that modified a user’s position, Euler would verify that the user’s collateral was still sufficient after the operation. If it wasn’t, the transaction would revert — fail safely. But the donation function skipped that check entirely. If you donated tokens out of your position, the protocol wouldn’t notice that you’d just made yourself dangerously undercollateralized.
That single missing line of code was the entire attack surface. Multiple audits had reviewed the codebase without catching this edge case. This is a pattern we covered in our post on what DeFi protocol audits actually tell you — audits reduce risk, but they cannot guarantee a protocol is flawless.
How the Euler Finance Exploit Worked (March 13, 2023)
The attacker used a flash loan — a loan that is borrowed and repaid within a single transaction block, requiring no collateral. If you want a deeper explanation of how flash loans enable these attacks, see our dedicated post on the mechanism. The Euler Finance exploit is a textbook example.
Here’s what happened, step by step:
- The attacker borrowed $30 million in DAI from Aave via a flash loan.
- They deposited that DAI into Euler, receiving eDAI (Euler’s deposit token), and borrowed additional funds against the deposit.
- They called
donateToReservesto donate a large chunk of eDAI back to the protocol. This made their position severely undercollateralized — but because the function skipped the health check, it went through without reverting. - They then triggered a self-liquidation: they liquidated their own undercollateralized position, capturing the liquidation bonus that the protocol normally pays to third-party liquidators as an incentive.
- The combination of the skipped health check and the self-liquidation let them extract far more value than they had put in. They repeated this across multiple asset pools.
- The flash loan was repaid within the same transaction. Aave’s records showed a clean repayment. The attacker walked away with approximately $197 million in DAI, USDC, stETH, and WBTC.
Total execution time: a few minutes. Total vulnerability: one missing function call. The DeFi lending hack of 2023 was elegant in the worst possible way.
The Aftermath: On-Chain Negotiation and Fund Recovery
Euler Labs responded immediately. They paused the protocol — preventing any further deposits or borrowing — and announced a $1 million bug bounty for information leading to fund recovery.
What followed over the next two weeks was something the industry hadn’t seen before: a public negotiation conducted entirely via on-chain messages. Euler Labs and security researchers sent messages attached to Ethereum transactions, addressed directly to the attacker’s wallet. The attacker sent confusing signals in return — including accidentally sending a small amount of ETH to a wallet linked to North Korean hackers. That mistake created potential criminal exposure and may have rattled the attacker significantly.
On March 25, 2023 — twelve days after the attack — the attacker’s wallet sent a message: “We want to make this right.”
Between March 25 and April 4, 2023, approximately $177 million was returned — roughly 90% of the stolen funds. Euler Labs distributed the recovered assets back to affected users. The remaining funds were kept. The attacker was never publicly identified.
Why did they return the money? No one knows for certain. The leading theories: legal pressure from the North Korea connection, the practical difficulty of laundering $197 million across multiple asset types, and possibly something closer to remorse — the attacker’s on-chain messages hinted at genuine conflict about the harm they’d caused.
What the Flash Loan DeFi Attack on Euler Reveals About Lending Risk
Before drawing lessons, it’s worth comparing outcomes across major DeFi hacks:
- Poly Network (2021): $611M stolen — 100% returned voluntarily.
- Euler Finance (2023): $197M stolen — ~90% returned.
- Wormhole (2022): $320M stolen — 100% restored, but via a $320M bailout from Jump Crypto, not the hacker.
- Ronin Bridge (2022): $625M stolen — less than a third ever recovered.
- Mt. Gox (2014): $450M lost — still partially unresolved more than a decade later.
The lesson is blunt: voluntary fund return is the exception, not the rule. Do not assume a protocol will be made whole after a hack. Build your risk management as if recovery will not happen — because statistically, it won’t.
Beyond the fund recovery question, the Euler Finance hack teaches several specific lessons about lending protocol risk:
Permissionless collateral listing creates a larger attack surface. Curated protocols like Aave review every asset before allowing it as collateral. That conservatism slows growth but limits the number of edge cases an attacker can exploit. Euler’s flexibility was a genuine innovation — and a genuine expansion of risk.
The health check must apply to every single function. Any function that modifies a user’s position must run the collateral check. One exception anywhere in the codebase is all it takes. The donateToReserves function wasn’t obviously dangerous — it was designed to add funds, not remove them — but any state-changing function can create unsafe positions if the safety check is missing.
More audits help, but audits are not a guarantee. Euler had passed multiple audits from reputable security firms before the attack. The bug was still there. Audits tell you a protocol took security seriously. They don’t tell you the code is flawless. No audit can catch every possible attack path, especially subtle ones involving unexpected function interactions.
What You Can Do Right Now
If you hold a position in any DeFi lending protocol, take five minutes this week:
- Go to DeFiLlama’s hacks tracker and look up your protocol’s security history.
- Count the number of audits, note when the most recent one was, and check whether the auditing firms are reputable (Trail of Bits, OpenZeppelin, ChainSecurity, Certora are established names).
- Find out whether the protocol uses a curated or permissionless collateral list. Curated is more conservative; permissionless means a wider range of edge cases.
- Consider spreading your lending positions across two or more protocols instead of concentrating everything in one. Diversification doesn’t eliminate risk, but it makes a single hack survivable.
Concentration risk is underestimated in DeFi. When one protocol fails, you lose everything deposited there. Euler users who had diversified lending positions across Aave and Compound were hurt far less than those who had concentrated everything on Euler.
The Euler Finance hack was, in many ways, a best-case outcome for a worst-case scenario. A novel vulnerability that passed multiple audits. A $197 million loss. And then, improbably, most of it came back. Don’t count on that happening the next time.
Subscribe to Crypto Clarified — our free weekly newsletter on staying safe in crypto. Every week: one case study, one risk framework, one thing you can actually do to protect your holdings.