How a missing safety check drained Euler Finance of $197 million — and why the attacker gave it all back

On the morning of March 13, 2023, a single attacker drained roughly $197 million from Euler Finance, an Ethereum lending protocol. According to Chainalysis, it was the largest DeFi hack of that year. What made it extraordinary came next: within about three weeks, essentially all of the money was returned.

The theft was not a stolen key or a phishing lure. It was a logic flaw — a missing safety check that let the attacker turn the protocol's own liquidation rules into a profit machine.

How the exploit worked

Using flash-loaned capital, the attacker deposited funds and over-leveraged through Euler's mint-and-borrow flow. They then called the `donateToReserves` function, donating a large share of their own collateral to the protocol's reserves.

That function lacked a health, or liquidity, check. It let the attacker deliberately push their own account into an unhealthy, liquidatable state without the contract stopping them. The attacker then self-liquidated.

The payoff came from Euler's liquidation math. A dynamic 'soft-liquidation' close factor handed liquidators an outsized discount on deeply unhealthy positions, so the liquidation bonus dwarfed the donation. Repeated across pools, the maneuver netted a fortune. The stolen assets spanned staked ETH — the largest share — plus USDC, Wrapped Bitcoin, and DAI.

Why the money came back

Recovery is rare in nine-figure DeFi hacks; this one is the exception. After public pressure and direct on-chain negotiation, the attacker began returning funds. Euler set a deadline, having signaled the attacker could keep roughly 10 percent as a bounty, and warned it would post a $1 million reward for information if 90 percent was not returned.

The returns arrived in tranches. Per Euler Labs, the first came on March 18 — 3,000 ETH, about $5.4 million. On March 25, roughly 51,000 ETH (~$88 million) plus another ~7,737 ETH (~$13 million) pushed the total past $101 million. Because ETH appreciated during the talks, about $240 million in assets was ultimately returned — more than the dollar value stolen. The final funds arrived on April 3, and Euler confirmed 100 percent recovery around April 3–4.

Attribution stayed murky. About 100 ETH briefly moved to a wallet tied to North Korea's Lazarus Group, fueling early speculation, but that theory was largely discounted once the attacker started giving the money back — behavior inconsistent with the group. In July 2023, DL News reported that a 20-year-old Argentinian, Federico Jaime — who used the name 'Jacob' in on-chain messages — claimed responsibility; DL News said it corroborated his identity but could not independently verify he was the main exploiter. His known legal exposure related to a separate French cash and money-laundering case.

Evaluating lending-protocol risk

The lesson is uncomfortable: Euler's code had been audited, and a single missing check still cost $197 million. The recovery here was luck and negotiation, not a safety net. Use this checklist before trusting a lending protocol with your funds.

• Audits are a floor, not a guarantee — check that they are recent, reputable, and cover the exact code that is deployed.
• Ask whether functions that move collateral (donations, transfers, reserve top-ups) re-verify account solvency afterward.
• Understand the liquidation model: dynamic close factors and large liquidation bonuses can be weaponized against the protocol.
• Favor protocols that run real-time monitoring and can pause contracts when anomalous flows appear.
• Prefer teams with a public incident-response plan and a track record of transparent disclosure.
• Treat yield that depends on complex leverage loops as concentrated smart-contract risk, not free money.

Euler remains one of the very few nine-figure exploits where nearly all recoverable funds reached users again. Do not count on being that lucky twice.

— Sources: [Chainalysis](https://www.chainalysis.com/blog/euler-finance-flash-loan-attack/) · [Euler Labs](https://www.euler.finance/blog/war-peace-behind-the-scenes-of-eulers-240m-exploit-recovery) · [CoinDesk](https://www.coindesk.com/business/2023/04/03/euler-says-all-recoverable-funds-stolen-in-200m-hack-have-been-returned) · [DL News](https://www.dlnews.com/articles/defi/argentinian-euler-hacker-explains-exploit-from-a-paris-jail/)