Summary
Euler Finance V1 was a permissionless DeFi lending protocol on Ethereum that launched in December 2021 and was exploited for approximately $197 million on March 13, 2023, in what was the largest DeFi hack of that year. The attack exploited a missing health check in the donateToReserves function introduced in EIP-14, despite the codebase having undergone multiple external audits. In a highly unusual outcome, the pseudonymous attacker known as 'Jacob' returned all recoverable funds by April 3, 2023, with the total recovered value reaching approximately $240 million due to ETH price appreciation during the recovery period.
Connected Entities
1 entities- + 3 more
Timeline(14 events)
2020-01-01
Euler Finance whitepaper published by founders including Michael Bentley.
2021-01-01
Euler Finance testnet launched.
2021-12-01
Euler Finance V1 launches on Ethereum mainnet.
2022-07-01
WatchPug audits EIP-14 upgrade for Sherlock; audit does not identify the donateToReserves vulnerability.
2023-03-13
Euler Finance V1 exploited via flash loan attack; approximately $197 million drained across DAI, USDC, stETH, and WBTC. Exploit transaction hash: 0x62bd3d31a7b75c098ccf28bc4d4af8c4a191b4b9e451fab4232258079e8b18c4.
2023-03-13
Euler Labs detects the attack and blocks the vulnerable module; protocol paused.
2023-03-14
Euler Labs announces $1 million reward for information leading to attacker identification and publicly offers attacker a 10% retention bounty (~$19.7M) to return remaining funds.
2023-03-17
Attacker sends 100 ETH to a wallet attributed by OFAC to North Korea's Lazarus Group, raising temporary state-actor attribution concerns.
2023-03-18
First return of funds: approximately 3,000 ETH (~$5.3M) transferred back to Euler.
2023-03-21
Lazarus Group-linked address sends on-chain phishing message to the Euler attacker, according to security researchers.
2023-03-25
Major return: 51,000 ETH (~$90M) returned by the attacker. Attacker using pseudonym 'Jacob' sends on-chain apology.
2023-04-03
Euler Labs announces all recoverable funds have been returned. Total recovered value: approximately $240 million (exceeding $197M stolen due to ETH price appreciation).
2024-02-01
Euler V2 announced following 31 additional security audits and extensive protocol redesign.
2024-09-01
Euler V2 launches on Ethereum mainnet with modular Euler Vault Kit (EVK) and Ethereum Vault Connector (EVC) architecture.
Decision Log
- hash: 43gbsx3S4btZdz3evBiR5BqsDBv4SLP9r9FF9whgX5JK
This investigation is cryptographically anchored to the Solana blockchain and source URLs are archived via the Internet Archive.
model: claude-sonnet-4-5
generated: 5/4/2026, 2:54:43 AM
last updated: 5/20/2026, 6:44:20 PM
avoid.net — verified advice for a post-truth world