On March 13, 2023, an attacker exploited Euler Finance, an Ethereum-based money market that supported permissionless listing and leveraged lending, draining approximately $197M across DAI, USDC, WBTC and stETH from the protocol's eToken vaults. The exploit chained a faulty donateToReserves function (introduced in the protocol's EIP-14 upgrade nine months earlier) with the use of mint-based leverage and self-liquidation to extract value, all wrapped in a flash loan that financed the attack with no upfront capital. The vulnerability had been audited by six firms over the protocol's lifetime, none of which flagged the specific interaction between donateToReserves and the violation-check bypass that the attacker exploited. After three weeks of public negotiation conducted partly through on-chain messages and partly through intermediaries including the Euler team's lawyer Mike Wuehler and white-hat negotiator samczsun, the attacker returned all stolen funds in a series of transactions in late March and early April 2023. Euler Finance reimbursed all affected users in full and remains the canonical case of a major DeFi exploit fully recovered through public-pressure negotiation, although the protocol's lending volumes never recovered to pre-exploit levels and its V2 product launched into a smaller market in 2024.
Timeline of events
Euler Finance launched on Ethereum mainnet in December 2021 as a permissionless money market that allowed any token-pair listing subject to a tier-based risk classification and that supported leveraged lending via mint-based eToken / dToken self-borrowing. The protocol grew steadily through 2021-2022 and held approximately $260M in TVL at its peak in early 2023. On June 21, 2022, Euler shipped EIP-14, an upgrade that introduced a donateToReserves function intended to allow account holders to voluntarily contribute eToken balances to the protocol's reserve pool. The function was reviewed by Halborn, Solidified, ZK Labs, Certora, Sherlock and Omniscia over the course of Euler's existence; none flagged the specific exploit path. On March 13, 2023, between 08:50 UTC and 09:23 UTC, an attacker executed six separate exploit transactions using a flash loan from Aave to seed each one, draining a total of approximately $197M: $135.8M of staked ETH (stETH), $33.8M of USDC, $18.5M of WBTC, and $8.7M of DAI. Euler's CEO Michael Bentley confirmed the exploit on Twitter at 10:21 UTC and the protocol's pause guardian halted further interactions within the hour. By March 13 evening, the Euler team had communicated publicly with the attacker via on-chain transaction memos requesting return of 90% of funds in exchange for a no-questions-asked agreement and 10% bounty. The attacker initially ignored the message and instead moved approximately 1,000 ETH to Tornado Cash. On March 21, the Euler team posted an on-chain ultimatum threatening a $1M bounty for information leading to identification. The attacker responded by returning a first tranche of approximately 5,000 ETH on March 25, followed by additional tranches over the following two weeks. By April 4, all stolen assets - aside from a small dust amount sent to a Korean exchange wallet that was subsequently frozen and recovered - had been returned to a recovery address controlled by Euler.
Attack mechanism
The exploit chained three separate mechanisms in a single transaction: leveraged self-borrowing, donateToReserves, and self-liquidation. In simplified form, the attacker used flash-loaned DAI to deposit collateral, then used Euler's mint function to atomically create a large eToken (deposit) position and a corresponding dToken (debt) position - this is the standard leveraged-lending primitive and was working as designed. The attacker then called donateToReserves, transferring a portion of the eToken balance to the protocol's reserve. Crucially, donateToReserves did not check whether the calling account was in a healthy collateralization state after the donation. By donating a large portion of the eToken collateral, the attacker created an account that was, from the protocol's perspective, severely under-collateralized: the dToken debt remained intact but the eToken collateral had been transferred out. The attacker then performed a self-liquidation of this artificially-distressed account using a separate attacker-controlled liquidator account. Euler's liquidation logic awarded a discount to the liquidator proportional to the severity of the violation, intended to incentivize liquidations of badly distressed accounts; because the artificially-induced violation was severe, the discount was correspondingly large. The liquidator account ended up with collateral worth substantially more than the debt it absorbed, and the attacker withdrew the surplus. The donateToReserves call in the EIP-14 upgrade had been intended as a simple voluntary-contribution path; the auditors who reviewed it had not modeled its interaction with the liquidation discount mechanism in the case of a self-induced violation. Forensic analyses by samczsun, BlockSec, and Omniscia, published in the days after the exploit, established this mechanism in detail. The attacker repeated the pattern across DAI, USDC, WBTC and stETH eToken markets in successive transactions.
Root cause analysis
The proximate cause was that donateToReserves did not invoke Euler's checkLiquidity hook before completing the eToken transfer to the reserve. Every other transfer-like function in the protocol invoked checkLiquidity post-hoc, ensuring that an account left the function in a healthy collateralization state; donateToReserves omitted this check on the assumption that voluntarily reducing one's deposit could not create violation-level distress, an assumption that was wrong because the corresponding dToken debt was not affected by the donation. The deeper cause was that Euler's permissionless mint-and-leverage primitive enabled the attacker to construct artificially-distressed accounts at will, by depositing flash-loaned collateral and using mint to create matching dToken debt, then donating away the collateral. The combination of an unchecked transfer (donateToReserves), a leverage primitive that allowed account distress to be self-induced (mint), and a liquidation incentive that scaled with violation severity (the dynamic discount) created an exploitable triangle. The audit firms that reviewed the protocol checked each component in isolation but did not model the attacker who would compose all three in a single transaction. This is now-standard analysis: composability bugs across audited components are a higher-order vulnerability class that requires explicit cross-function and cross-feature threat-modeling. The Euler exploit became one of the canonical examples cited in subsequent audit-methodology papers (Trail of Bits, ConsenSys Diligence, OpenZeppelin) emphasizing the need for property-based testing across feature interactions.
Initial response and recovery
Euler's initial response was rapid and disciplined. Within an hour of the first exploit transaction, the protocol's pause guardian (a multi-sig held by core contributors and external advisors) halted all new interactions, preventing any further drain even though the existing positions remained on-chain. The Euler team retained Mike Wuehler and engaged samczsun and other white-hat negotiators to communicate with the attacker via on-chain messages. The first message, posted on March 13, offered a 90% return / 10% bounty deal with no public identification. The attacker did not respond and instead moved a small amount of ETH to Tornado Cash, a posture that initially suggested the funds would be laundered. Euler's negotiation strategy then shifted on March 21 to a public ultimatum: a $1M bounty offered to any party providing information leading to the attacker's arrest, accompanied by a clear deadline. Behind the scenes, intermediaries communicated to the attacker that on-chain forensic clustering by ZachXBT, Chainalysis and others had developed leads, and that off-ramping the stolen funds would be substantially impeded by exchange-level address blacklisting that had already been coordinated by the Euler team with Binance, Coinbase, and others. The attacker initiated returns on March 25 with a 5,000 ETH transaction, and over the following ten days returned the bulk of remaining funds in a series of staggered transactions, accompanied by on-chain messages from the attacker's address that took various tones from contrite to defiant. By April 4, 2023, all returned funds plus a residual dust portion recovered separately had been consolidated in a multi-signature recovery wallet. Euler proceeded to a structured creditor-distribution exercise that fully reimbursed all affected users in their original asset denominations.
Funds tracking and laundering
The attacker's laundering infrastructure was modest by comparison with Lazarus-scale operations. Approximately 1,000 ETH was deposited to Tornado Cash in the first 48 hours after the exploit, but no further deposits occurred after the public negotiation began. ZachXBT's clustering established that several of the attacker's funding addresses had origins traceable to a Korean-region exchange withdrawal made approximately two months prior to the exploit, and additional clustering connected the attacker's footprint to OTC purchases that, while not conclusively identifying, narrowed the candidate set substantially. The attacker's eventual on-chain message exchanges with the Euler team, which were partly conducted in plain text, revealed an individual rather than an organized group, with an apparent age in the early-to-mid twenties and an apparent location somewhere in the East Asian time-zone band. The attacker was never publicly identified by name, arrested, or charged, and no public indictment exists. The voluntary return of substantially all funds, combined with the attacker's apparent location outside any extraditable jurisdiction, has produced a stable equilibrium in which prosecution has not occurred and is not expected.
Legal and regulatory aftermath
The Euler exploit produced no significant criminal proceedings, in part because of the full recovery and in part because the attacker's identity is publicly attributed but not publicly indicted. Civil litigation was minimal: Euler's user agreements disclaimed protocol-level guarantees, and full reimbursement obviated the standard plaintiffs' incentives that drive class actions in unrecovered-loss cases. From a regulatory perspective, the U.S. Department of the Treasury's Office of Foreign Assets Control did not issue addresses-specific designations because the attacker did not appear to be associated with sanctioned jurisdictions or organizations. Neither the EU's MiCA framework nor the UK Financial Conduct Authority produced Euler-specific findings, designations, or rulemaking; the case drew comparatively little formal regulatory attention, in large part because of the full recovery. The most concrete regulatory effect was negative: the protocol's institutional partners, including several DAO treasuries that had used Euler for yield, formalized stricter due-diligence requirements that had downstream effects on permissionless-listing money markets generally.
Industry implications
Three industry shifts trace partly to the Euler exploit. First, audit methodology evolved to emphasize cross-function and cross-feature property testing, with firms including Certora and Trail of Bits explicitly citing donateToReserves as a motivating example for property-based formal verification of invariants like 'no function can leave an account in violation' across all entry points. Second, the practice of public on-chain negotiation with attackers - now sometimes called the post-exploit dialogue protocol - became a more accepted operational tool, with subsequent exploits at Mango Markets, Curve, Platypus, and others using analogous techniques with varying success. Third, white-hat negotiation infrastructure consolidated around a small set of trusted intermediaries (samczsun, ZachXBT, Mudit Gupta, the Seal-911 collective) whose track records of successful return arrangements made them effective channels for protocols facing similar situations. Negative implications also accumulated: Euler's TVL never recovered to pre-exploit levels even after full reimbursement, illustrating that capital memory persists even when financial loss is reversed; the V2 protocol launched in 2024 into a substantially smaller addressable market. The full-recovery outcome also created a moral hazard concern that has been debated in the security community: an attacker who reliably returns funds under public pressure may be effectively immune from prosecution, potentially encouraging speculative exploit attempts on the assumption that successful funds-return negotiations are a viable exit.
Verdict and lessons
Euler Finance is the canonical case of a DeFi exploit fully recovered through public-pressure negotiation, and is therefore the standing reference for protocols evaluating their post-exploit playbook. The technical lessons are unambiguous: protocol invariants must be checked across all entry points (the every-function-must-leave-the-account-healthy invariant), composability must be modeled across functions and features rather than only within them, and audit firms must explicitly threat-model leverage-induced and self-induced distress in money-market designs. The operational lessons are equally important: pause guardians must be capable of halting interactions within minutes of detection, public on-chain communication with attackers can be effective when combined with credible off-ramp blocking, and engagement with experienced white-hat negotiators substantially raises the probability of return. The deeper lesson is structural: the attacker's calculus in choosing whether to return funds depends on the perceived ratio of liquid post-laundering value to identification risk, and protocols can shift that ratio by coordinating exchange blacklisting and forensic-investigator involvement quickly enough that off-ramping becomes expected to fail. When the math favors return, return is rational. Euler's full recovery did not happen by luck; it happened because the protocol's response moved that math, deliberately and quickly. Subsequent protocols facing similar exploits have explicitly modeled the Euler playbook, and several (notably Curve in July 2023) have achieved partial-recovery outcomes by following analogous procedures.
Root cause
donateToReserves function in Euler's EIP-14 upgrade did not invoke the checkLiquidity hook after transferring eToken collateral to the protocol's reserve, allowing the caller to leave their account in a violation state. Combined with Euler's mint-based leverage primitive (which allowed self-induced collateralization distress) and its dynamic liquidation-discount mechanism (which scaled the liquidator reward with violation severity), this enabled an attacker to flash-loan capital, mint a large leveraged position, donate the collateral away, and then self-liquidate the resulting distressed account via a second attacker-controlled liquidator address, capturing the discount as profit.
Recovery and aftermath
Public on-chain negotiation conducted by Euler team with intermediary support from samczsun, ZachXBT and Mike Wuehler, combined with coordinated exchange blacklisting and a $1M bounty for identification, induced the attacker to return all stolen funds in a series of staggered transactions between March 25 and April 4, 2023. Euler subsequently performed a structured creditor distribution that fully reimbursed all affected users in their original asset denominations. A small dust amount sent to a Korean exchange wallet was frozen and recovered separately. The full-recovery outcome remains the largest successful funds-return in DeFi history.
Lessons
- Every state-modifying function must check the relevant protocol invariants on the calling account, particularly in protocols supporting leverage where account distress can be self-induced
- Audit methodology must explicitly model cross-function and cross-feature composition, not only individual-function correctness; property-based testing of invariants across all entry points is the modern minimum
- Pause-guardian execution capability within minutes of detection is the operational baseline; protocols without this capability have insufficient time to negotiate or coordinate
- Public on-chain negotiation combined with coordinated exchange blacklisting and credible identification pressure can induce voluntary return; speed of execution determines whether the math favors return
Precedent
Established the public on-chain dialogue protocol as a viable post-exploit recovery tool when combined with coordinated exchange blacklisting and credible identification pressure. Drove industry adoption of property-based formal verification for cross-function invariants in money-market designs. Demonstrated that pause-guardian execution within minutes of detection can prevent further drain even when the on-chain damage is already done. Established samczsun, ZachXBT, and the Seal-911 collective as canonical intermediaries for white-hat negotiation in subsequent exploits.