Summary
On 13 March 2023 the Ethereum lending protocol Euler Finance was drained of about $197 million, the biggest DeFi hack of the year. The attacker did not steal a key or break any cryptography. They borrowed a fortune with a flash loan, used a single missing safety check in Euler's code to deliberately push their own position into bad debt, and then exploited Euler's own liquidation rules to be paid far more than they were owed. In a now-familiar twist, the attacker, identifying only as "Jacob," gave more than all of it back over the following weeks. It is a clean lesson in DeFi's defining risk: composable money where one unchecked code path can be turned into a money pump.
How it happened
Euler is a DeFi lending protocol, and the bug was mundane: a function called donateToReserves let a user donate tokens to the protocol's reserves without checking that the donation left their own account solvent. That single missing health check was the whole opening, and tellingly the function had been added later in a governance upgrade, in scope for only one of Euler's ten-odd audits.
The attacker turned it into a machine. First they took a roughly $30 million flash loan from Aave, free capital for one transaction. They used Euler's leveraged minting (up to about 19x) to build an enormous position, then called donateToReserves to give away enough of their own collateral (dropping it to about 310 million against 390 million in debt tokens) to shove the account into bad debt on purpose. Finally they self-liquidated through a second address. Euler's "soft liquidation" logic applied a discount that grew with how unhealthy the account was, up to 20%, so the liquidator (the attacker's other wallet) was handed far more collateral than the debt was worth. Repeated across six token pools (DAI, stETH, WBTC, USDC and more), the same donate-then-self-liquidate cycle pulled out roughly $197 million in all.
The recovery
What made Euler unusual was the ending. After days of on-chain negotiation, public pressure, and Euler offering to drop legal action and pay a bounty if most of the money came back, the attacker returned more than all of it, around $240 million, because the stolen ~$197 million had appreciated with ETH during the three weeks of back-and-forth. Euler confirmed the recovery complete on 3 April 2023. As with the Poly Network theft, the transparency of the blockchain turned out to be the protocol's best leverage: the money was always in plain view.
Why Euler still matters
Euler is the archetypal modern DeFi hack: a flash-loan-amplified logic bug. There was nothing exotic, just a function that changed balances without re-checking the account's health, weaponised with free borrowed capital and the protocol's own liquidation incentives. The lessons are precise: run a health and solvency check on every balance-changing path, including donations and transfers out of a position; apply checks-effects-interactions and re-validate account health after each state change; cap liquidation discounts so a liquidator can never be paid more than the debt plus a sane incentive; and add invariant tests asserting that no single atomic operation can move a healthy account into bad debt. Above all, treat a flash-loaned, single-transaction leverage cycle as a standard adversarial scenario, because attackers always will, and re-audit any feature added after the original review. It sits alongside the Curve hack as a defining DeFi failure of 2023.
How to fix it
- Pause the protocol and patch the unchecked path (here, the donate function) to enforce a solvency check before any balance change is finalized.
- Re-audit every other balance-changing function for the same missing check, since this bug class rarely appears alone, and re-audit features added after the original review.
- Trace funds and negotiate recovery on-chain; Euler recovered more than everything through traceability and public pressure.
How to avoid it
- Run a health/solvency check on every balance-changing path, including donations and transfers out of positions.
- Apply checks-effects-interactions and re-validate account health after each state mutation.
- Cap or floor liquidation discounts so liquidators cannot be paid more than the debt plus reasonable incentive.
- Add invariant tests asserting no operation can move a healthy account into bad debt atomically.
- Treat flash-loaned, single-transaction leverage cycles as a tested adversarial scenario, and re-audit governance-added functions.
References
- https://www.chainalysis.com/blog/euler-finance-flash-loan-attack/
- https://www.euler.finance/blog/war-peace-behind-the-scenes-of-eulers-240m-exploit-recovery
- https://medium.com/@omniscia.io/euler-finance-incident-post-mortem-1ce077c28454
- https://blocksec.com/blog/euler-finance-incident-the-largest-hack-of-2023
Related vulnerabilities
All Web3 →- CRITICALWEB3-PENPIE-2024
On September 3, 2024, Penpie, a yield protocol built on Pendle, was drained of about $27.3 million (11,113.6 ETH in wstETH, sUSDe, egETH and rswETH) across Ethereum and Arbitrum. The root cause was a cross-function reentrancy enabled by permissionless market registration: registerPenpiePool trusted any market from Pendle's PendleMarketFactoryV3 without validating the Standardized Yield (SY) token, so the attacker registered a fake market whose SY was their own contract. PendleStakingBaseUpg.batchHarvestMarketRewards (and its internal _harvestBatchMarketRewards) snapshotted reward-token balances before and after calling the market's redeemRewards, but lacked a nonReentrant guard. The malicious SY's claimRewards callback re-entered PendleStakingBaseUpg.depositMarket with flash-loaned Pendle LP tokens mid-accounting, so the deposit was misattributed as harvested rewards, inflating the attacker's reward balance. Although depositMarket itself carried a nonReentrant modifier, the two functions did not share a lock, so the unguarded harvest path let the attacker re-enter the guarded deposit path and claim the inflated rewards via MasterPenpie.multiclaim.
- CRITICALWEB3-PLAYDAPP-2024
Between February 9 and 12, 2024, the South Korean crypto gaming and NFT platform PlayDapp was exploited twice for about $290M after a privileged-key compromise. Around January 16, 2024 the attacker spear-phished the PLA token deployer with a domain-spoofed email whose attachment installed a remote-access tool, giving control of the deployer's machine and its private key. PLA used a custom MinterRole/Ownable mint-permission pattern, so the attacker called addMinter(address) (method ID 0x983b2d56) on the PLA contract (0x3a4f40631a4f906c2BaD353Ed06De7A5D3fCb430) to authorize their own address as an authorized minter, then minted over 200 million PLA (~$36.5M) on February 9 and a further 1.59 billion PLA (~$253.9M) on February 12. PlayDapp's $1M return offer was ignored; PLA trading was suspended and exchanges worked to freeze funds, with most of the inflated supply effectively unsellable due to thin liquidity.
- CRITICALWEB3-CURVE-VYPER-2023
On 30 July 2023, several Curve Finance pools were drained of about $70 million, and the bug was not in Curve's code at all. It was in the compiler. Specific versions of Vyper, the programming language many Ethereum contracts are written in, generated a broken reentrancy guard, so the protection developers thought they had was silently not working. It is the rare and unsettling case of a reentrancy attack reaching contracts whose authors had correctly added the guard, because the tool that built them betrayed them. It put the spotlight on the compiler and the build pipeline as part of a smart contract's trust boundary.
- CRITICALWEB3-CONIC-2023
On 21 July 2023 Conic Finance's ETH Omnipool on Ethereum lost roughly 1,700 ETH, about $3.6 million, to a read-only reentrancy attack. The attacker flash-loaned around $134 million, deposited into the Curve rETH pool, then called Curve's remove_liquidity(), which sends ETH to the recipient before the pool's totalSupply and balances are finalized, triggering the attacker contract's fallback during an inconsistent intermediate state. Inside that callback the attacker re-entered ConicEthPool.withdraw(), causing Conic's Curve LP oracle to value the LP token from Curve's virtual price and totalSupply while the pool was mid-operation, returning an inflated price. Conic's reentrancy guard was bypassed because its _isETH check assumed Curve v2 ETH pools list the native ETH placeholder address (0xEeee...EEeE) as a coin, whereas they actually use the WETH address, so the guard never fired. The inflated valuation let the attacker mint excess cncETH and withdraw more than deposited.
- CRITICALWEB3-HARMONY-HORIZON-2022
On June 24, 2022, Harmony's Horizon bridge was exploited for approximately $99.7 million. The Ethereum-side bridge was secured by a 5-validator multisig configured at a low 2-of-5 threshold, so compromising just two keys gave full control of the funds. Per Harmony's post-mortem the private keys were not stored in plaintext but were doubly encrypted via a passphrase and a key management service, with no single machine holding multiple plaintext keys; the attacker nonetheless breached Harmony's hot signing infrastructure and was able to access and decrypt several keys, including those used to sign the unauthorized transfers, because the decryption capability lived within reach of the compromised environment. With two decrypted keys meeting the threshold, the attacker signed and confirmed the drain across 11 transactions (the 2 refers to the signature threshold, not the transaction count). The FBI and Elliptic attributed the theft to North Korea's Lazarus Group (APT38); the stolen assets were swapped to Ether and laundered through Tornado Cash and later RAILGUN.
- CRITICALWEB3-RARI-FEI-2022
On 30 April 2022 the Rari Capital / Fei Protocol Fuse lending pools on Ethereum lost approximately $80 million (about $79.7 million across ETH, FEI, DAI, LUSD and USDC). Fuse pools were a fork of Compound's CToken, but the CEther contract sent ETH using low-level call.value() instead of Compound's gas-capped transfer(), forwarding all remaining gas to the recipient's fallback. The borrow() function called doTransferOut(), which performed that call.value() ETH transfer to the borrower before the borrow and collateral accounting was finalized, violating checks-effects-interactions. The attacker's fallback re-entered the Comptroller's exitMarket() while the deposited collateral was still counted as backing the loan, freeing the collateral while keeping the borrowed ETH; the Comptroller's reentrancy guard did not cover exitMarket on the affected pools. Funded by Balancer flash loans, this cross-contract reentrancy drained seven pools.