Audit log

Every state-changing event for Euler V1: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-05-20 18:44:20Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 421,042,216

   sig

   2FgHGwJmjsCg…qin3jduXcopyexplorer ↗

   hash

   43gbsx3S4btZ…9whgX5JKcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (7676 B) ▸

   {"actor":"system:backfill","investigation_id":"f33e91a4-0b1f-4ec9-925b-da21e05a4068","kind":"publish","page_slug":"euler-v1","published_at":"2026-05-20T18:44:20.046Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Euler V1","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://tokenterminal.com/resources/interview/interview-with-euler-finance-ceo-michael-bentley"},{"credibility":3,"name":"","type":"other","url":"https://www.gate.com/learn/articles/what-is-euler-finance-all-you-need-to-know-about-eul/5605"},{"credibility":3,"name":"","type":"other","url":"https://messari.io/project/euler-finance"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.theblock.co/post/219196/euler-finance-flash-loan-attacked-for-an-estimated-197-million"},{"credibility":3,"name":"","type":"other","url":"https://www.bloomberg.com/news/articles/2023-03-13/defi-s-euler-finance-hit-by-197-million-hack-experts-say"},{"credibility":3,"name":"","type":"other","url":"https://www.chainalysis.com/blog/euler-finance-flash-loan-attack/"},{"credibility":3,"name":"","type":"other","url":"https://www.certik.com/resources/blog/4iSrYY6HoaYxk1aKyjFb5v-euler-finance-incident-analysis"},{"credibility":3,"name":"","type":"other","url":"https://www.cyfrin.io/blog/how-did-the-euler-finance-hack-happen-hack-analysis"},{"credibility":3,"name":"","type":"other","url":"https://www.zellic.io/blog/euler-finance-exploit-analysis/"},{"credibility":3,"name":"","type":"other","url":"https://blocksec.com/blog/euler-finance-incident-the-largest-hack-of-2023"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://etherscan.io/tx/0x62bd3d31a7b75c098ccf28bc4d4af8c4a191b4b9e451fab4232258079e8b18c4"},{"credibility":3,"name":"","type":"other","url":"https://etherscan.io/address/0xb2698c2d99ad2c302a95a8db26b08d17a77cedd4"},{"credibility":3,"name":"","type":"other","url":"https://www.coindesk.com/business/2023/03/21/hacker-vs-hacker-north-koreans-attempt-to-phish-euler-exploiter-of-200m-in-crypto-experts-say"},{"credibility":3,"name":"","type":"other","url":"https://cryptoslate.com/north-korean-lazarus-group-tries-to-phish-euler-exploiter/"},{"credibility":3,"name":"","type":"other","url":"https://www.coinbase.com/blog/euler-compromise-investigation-part-1-the-exploit"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.coindesk.com/business/2023/04/03/euler-says-all-recoverable-funds-stolen-in-200m-hack-have-been-returned"},{"credibility":3,"name":"","type":"other","url":"https://www.coindesk.com/tech/2023/03/28/hacker-behind-200m-euler-attack-apologizes-returns-millions-in-ether-dai-to-protocol"},{"credibility":3,"name":"","type":"other","url":"https://www.theblock.co/post/224705/euler-hacker-returns-funds"},{"credibility":3,"name":"","type":"other","url":"https://www.euler.finance/blog/war-peace-behind-the-scenes-of-eulers-240m-exploit-recovery"},{"credibility":3,"name":"","type":"other","url":"https://fortune.com/crypto/2023/04/06/how-an-elite-team-pressured-a-hacker-to-return-200m-he-stole-from-defi-platorm-euler/"},{"credibility":3,"name":"","type":"other","url":"https://decrypt.co/125373/euler-finance-exploiter-returns-recoverable-funds-200m-hack"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.theblock.co/post/314655/euler-launches-v2-modular-defi-lending-protocol-following-hack"},{"credibility":3,"name":"","type":"other","url":"https://blockworks.com/news/euler-finance-exploit-comeback"},{"credibility":3,"name":"","type":"other","url":"https://thedefiant.io/news/people/euler-ceo-michael-bentley-steps-down"},{"credibility":3,"name":"","type":"other","url":"https://www.dlnews.com/articles/defi/euler-co-founder-lost-38m-worth-of-governance-tokens-after-hardware-failure/"},{"credibility":3,"name":"","type":"other","url":"https://www.ibtimes.com/exclusive-euler-labs-ceo-overcoming-exploit-re-emergence-security-first-v2-3741973"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://medium.com/@omniscia.io/euler-finance-incident-post-mortem-1ce077c28454"},{"credibility":3,"name":"","type":"other","url":"https://olympixai.medium.com/eulers-197m-collapse-shows-why-invariants-matter-more-than-audits-451da9026e12"},{"credibility":3,"name":"","type":"other","url":"https://www.euler.finance/blog/securing-euler"},{"credibility":3,"name":"","type":"other","url":"https://cointelegraph.com/news/euler-finance-attack-how-it-happened-and-what-can-be-learned"}]}],"sources_used":[],"summary":"Euler Finance V1 was a permissionless DeFi lending protocol on Ethereum that launched in December 2021 and was exploited for approximately $197 million on March 13, 2023, in what was the largest DeFi hack of that year. The attack exploited a missing health check in the donateToReserves function introduced in EIP-14, despite the codebase having undergone multiple external audits. In a highly unusual outcome, the pseudonymous attacker known as 'Jacob' returned all recoverable funds by April 3, 2023, with the total recovered value reaching approximately $240 million due to ETH price appreciation during the recovery period.","timeline":[{"date":"2020-01-01","event":"Euler Finance whitepaper published by founders including Michael Bentley.","source":""},{"date":"2021-01-01","event":"Euler Finance testnet launched.","source":""},{"date":"2021-12-01","event":"Euler Finance V1 launches on Ethereum mainnet.","source":""},{"date":"2022-07-01","event":"WatchPug audits EIP-14 upgrade for Sherlock; audit does not identify the donateToReserves vulnerability.","source":""},{"date":"2023-03-13","event":"Euler Finance V1 exploited via flash loan attack; approximately $197 million drained across DAI, USDC, stETH, and WBTC. Exploit transaction hash: 0x62bd3d31a7b75c098ccf28bc4d4af8c4a191b4b9e451fab4232258079e8b18c4.","source":""},{"date":"2023-03-13","event":"Euler Labs detects the attack and blocks the vulnerable module; protocol paused.","source":""},{"date":"2023-03-14","event":"Euler Labs announces $1 million reward for information leading to attacker identification and publicly offers attacker a 10% retention bounty (~$19.7M) to return remaining funds.","source":""},{"date":"2023-03-17","event":"Attacker sends 100 ETH to a wallet attributed by OFAC to North Korea's Lazarus Group, raising temporary state-actor attribution concerns.","source":""},{"date":"2023-03-18","event":"First return of funds: approximately 3,000 ETH (~$5.3M) transferred back to Euler.","source":""},{"date":"2023-03-21","event":"Lazarus Group-linked address sends on-chain phishing message to the Euler attacker, according to security researchers.","source":""},{"date":"2023-03-25","event":"Major return: 51,000 ETH (~$90M) returned by the attacker. Attacker using pseudonym 'Jacob' sends on-chain apology.","source":""},{"date":"2023-04-03","event":"Euler Labs announces all recoverable funds have been returned. Total recovered value: approximately $240 million (exceeding $197M stolen due to ETH price appreciation).","source":""},{"date":"2024-02-01","event":"Euler V2 announced following 31 additional security audits and extensive protocol redesign.","source":""},{"date":"2024-09-01","event":"Euler V2 launches on Ethereum mainnet with modular Euler Vault Kit (EVK) and Ethereum Vault Connector (EVC) architecture.","source":""}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision a314fb8a-9177-41de-af9f-a0b274ca9474copy
2. #2rescoreby systemsystem

   2026-10-10 18:49:36Z
   Score: 10 → 59 (+49)
   Rescored under Scoring v2, the published formula (avoid.net/scoring): 10 → 59. Problems weighed by who is responsible: incidents the subject suffered −12.8, problems around the subject, caused by others −1.6; legitimacy credit long-running +8.
   anchoranchored

   chain

   ●mainnet-betaslot 455,369,726

   sig

   5obcuv1v4KLH…Mf8sU6PXcopyexplorer ↗

   hash

   4TdM5UiWXvuk…fHNoQ4Ebcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (606 B) ▸

   {"actor":"system","decided_at":"2026-10-10T18:49:36.518Z","decision":"rescore","investigation_id":"f33e91a4-0b1f-4ec9-925b-da21e05a4068","new_score":59,"page_slug":"euler-v1","prev_score":10,"reason":"Rescored under Scoring v2, the published formula (avoid.net/scoring): 10 → 59. Problems weighed by who is responsible: incidents the subject suffered −12.8, problems around the subject, caused by others −1.6; legitimacy credit long-running +8.","score_delta":49,"score_model":"v2","sequence_num":2,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision ff4b2b7c-df6e-4a4f-b6b9-10ae13bf58a8copy
3. #3reviewby reviewerreviewer

   2026-11-02 04:46:17Z
   Score: 59 → 59 (no score change)
   Core facts (March 13, 2023 exploit of about $197M, staged returns on March 18, March 25 and April 3, V2 launch in September 2024) match independent reporting. The EUL allocation figures, the Lazarus 100 ETH detail and the DL News item could not be verified, and the Bentley departure has no date. No contradictions or critical omissions were found. Sampling was limited, since most cited URLs were not fetched.
   anchoranchored

   chain

   ●mainnet-betaslot 464,365,994

   sig

   4GmjK6sjHJfY…JMCvnQqncopyexplorer ↗

   hash

   DLqYosbCE3tW…L29mzxnTcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1257 B) ▸

   {"actor":"reviewer","artifact_identity":"966888a299716b7944a583c341a139a4","blocked_count":2,"decided_at":"2026-11-02T04:46:17.099Z","decision":"review","disputed_pct":0.1667,"findings_hash":"9vukVXsbPLMbwiKMamTUskjR3mv2cMu6qDgVqHjV4BDB","investigation_id":"f33e91a4-0b1f-4ec9-925b-da21e05a4068","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":59,"page_content_hash":"903ec13b1bd1c0ec83c18c763d301bec76208369e512259f54a936a52f1e3ace","page_slug":"euler-v1","prev_score":59,"reason":"Core facts (March 13, 2023 exploit of about $197M, staged returns on March 18, March 25 and April 3, V2 launch in September 2024) match independent reporting. The EUL allocation figures, the Lazarus 100 ETH detail and the DL News item could not be verified, and the Bentley departure has no date. No contradictions or critical omissions were found. Sampling was limited, since most cited URLs were not fetched.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"scored_claims":6,"sequence_num":3,"subject_status":"operating","subject_status_contradicts_page":false,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 86d1a98a-d1ff-4530-aeca-e8e68873fd0ecopy
4. #4review reviseby judgejudge

   2026-11-02 04:46:17Z
   Score: 59 → 59 (no score change)
   The core facts hold up: the March 13, 2023 exploit of about $197M, the staged fund returns, and the September 2024 V2 launch were confirmed (claim_findings[0], [1], [2]). The EUL allocation percentages (claim_findings[6]) could not be verified. Two further claims were not checked because their sources blocked the reviewer, so they are a coverage limit rather than a defect. After excluding those two, 1 of 6 checked claims is unverifiable (about 17%), which puts the page in the minor-issues band. Two claims were only partly supported: the founding year is loosely stated, and the Bentley departure has no date. The reviewer's confidence is low (0.5) and most cited URLs were not fetched, so the penalty is kept at the mild end.
   anchoranchored

   chain

   ●mainnet-betaslot 464,365,999

   sig

   3yXr6ip6A3uW…6KK3BHDYcopyexplorer ↗

   hash

   DWK6sNLpaEA5…EME1R64Dcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1409 B) ▸

   {"actor":"judge","artifact_identity":"966888a299716b7944a583c341a139a4","band_override":null,"blocked_count":2,"decided_at":"2026-11-02T04:46:17.099Z","decision":"review_revise","delist_requested":false,"disputed_pct":0.1667,"investigation_id":"f33e91a4-0b1f-4ec9-925b-da21e05a4068","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":59,"page_slug":"euler-v1","prev_score":59,"reason":"The core facts hold up: the March 13, 2023 exploit of about $197M, the staged fund returns, and the September 2024 V2 launch were confirmed (claim_findings[0], [1], [2]). The EUL allocation percentages (claim_findings[6]) could not be verified. Two further claims were not checked because their sources blocked the reviewer, so they are a coverage limit rather than a defect. After excluding those two, 1 of 6 checked claims is unverifiable (about 17%), which puts the page in the minor-issues band. Two claims were only partly supported: the founding year is loosely stated, and the Bentley departure has no date. The reviewer's confidence is low (0.5) and most cited URLs were not fetched, so the penalty is kept at the mild end.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"scored_claims":6,"sequence_num":4,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision f491b40b-8e55-4855-a6be-1460af22fcc6copy
5. #5rescoreby systemsystem

   2026-11-02 04:46:18Z
   Score: 59 → 62 (+3)
   Recalculated after the fact-check of 2026-11-02. Rescored under Scoring v2, the published formula (avoid.net/scoring): 59 → 62. Problems weighed by who is responsible: incidents the subject suffered −9.6, problems around the subject, caused by others −1.6; legitimacy credit long-running +8; 1 section(s) set aside until a failed fact-check is resolved.
   anchoranchored

   chain

   ●mainnet-betaslot 464,366,004

   sig

   438pETm1T73B…PNGD8Ufdcopyexplorer ↗

   hash

   GnP8t9PoXLxZ…NngYtijPcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (715 B) ▸

   {"actor":"system","decided_at":"2026-11-02T04:46:17.099Z","decision":"rescore","investigation_id":"f33e91a4-0b1f-4ec9-925b-da21e05a4068","new_score":62,"page_slug":"euler-v1","prev_score":59,"reason":"Recalculated after the fact-check of 2026-11-02. Rescored under Scoring v2, the published formula (avoid.net/scoring): 59 → 62. Problems weighed by who is responsible: incidents the subject suffered −9.6, problems around the subject, caused by others −1.6; legitimacy credit long-running +8; 1 section(s) set aside until a failed fact-check is resolved.","score_delta":3,"score_model":"v2","sequence_num":5,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision d5226e20-2a88-4d0a-a55a-78f676fae026copy