Euler Finance Hacker Returns All Recoverable Funds

The exploiter behind the multi-million dollar Euler Finance attack has returned all recoverable funds, the decentralized finance (DeFi) lending protocol announced Tuesday.

In a Twitter post, the project’s development team disclosed that the hacker returned all the funds after successful negotiations.

Euler Finance Receives Stolen Funds

Recall that Euler lost roughly $200 million on March 13 in a flash loan attack. The incident was recorded as the biggest loss for crypto in Q1, 2023.

As CryptoPotato reported, the exploiter stole $8.7 million worth of the decentralized stablecoin DAI, $34 million worth of USD Coin (USDC), $19 million wrapped bitcoin (WBTC), and $136 million worth of staked Ether (ETH). The attacker borrowed the assets through a flash loan and drained them from the protocol.

About two days after the exploit, Euler Finance publicly offered the attacker a deal to keep 10% of the stolen assets if they agreed to return the remaining funds. The protocol eventually disclosed that the Euler Foundation was offering a $1 million reward to anyone with information about the hacker in case the funds were not returned.

However, the exploiter moved on to mix the stolen crypto in Tornado Cash, ignoring the proposal. The attacker sent 100 ETH in ten transactions to an intermediary address, making it harder for Euler to trace the IRL.

Interestingly, on-chain data showed an interaction between the wallet tied to Euler’s attack and another related to Axie Infinity’s Ronin Network $625 million hack. The latter sent an encrypted message to Euler’s exploiter with instructions to decrypt the message with the private key of the address it was sent to.

In response to the message, the Euler exploiter revealed that they intended to return the stolen funds to the protocol’s team, saying that they would communicate soon.

Euler’s $1M Offer is Off

Four days after the disclosure, the perpetrator returned over $104 million in ETH to Euler Finance. The first transaction held 51,000 ETH, while the second was worth 7,737 ETH.

With time, the hacker apologized for the incident and sent roughly $77 million in two transactions holding 31,000 ETH and 30 million DAI. 

Since he has sent the remaining $18 million in ETH and $13 million in DAI, Euler has decided to call off the $1 million reward campaign launched initially.

Because the exploiter did the right thing and returned the funds, and the $1 million reward campaign launched by the Euler Foundation will no longer be accepting new information.

Full details to follow tomorrow.

— Euler Labs (@eulerfinance) April 3, 2023