How much was lost in the Euler Finance hack?

$197M Flash Loan Attack, as publicly reported (March 13, 2023).

Who was behind the Euler Finance hack?

Publicly attributed to Unknown (funds returned). ChainHint does not attribute the attacker independently — it traces the funds from the address on the public record and reports where they went.

Case Studies/Euler Finance

Euler Finance Hack: $197M Flash Loan Attack

Q: How was the Euler Finance hack carried out?

Flash Loan Setup. Attacker borrowed 30M DAI via flash loan from Aave v2, used it to mint eDAI (Euler's wrapped token). Simultaneous borrow and repay created a position where donated collateral artificially inflated the reserve balance without triggering the liquidity check.

March 13, 2023 · Ethereum · Unknown (funds returned)

exploited

$197M

recovered

$177M

transaction

to return

2 weeks

What happened

On March 13, 2023, Euler Finance — a permissionless lending protocol on Ethereum — suffered the largest DeFi hack of 2023 at the time: $197M drained via a sophisticated flash loan re-entrancy exploit. The attacker weaponized a flaw in Euler's donation mechanism (`donateToReserves`) that bypassed the health-check guard, allowing a single transaction to simultaneously hold massive debt and trigger liquidations against their own position. The hack was notable for its unexpected resolution: after failed negotiations and an on-chain ultimatum, the attacker returned $177M — keeping only ~$20M — making it one of the few DeFi exploits with a partial recovery.

How the funds moved

Step 1

Flash Loan Setup

Attacker borrowed 30M DAI via flash loan from Aave v2, used it to mint eDAI (Euler's wrapped token). Simultaneous borrow and repay created a position where donated collateral artificially inflated the reserve balance without triggering the liquidity check.

Step 2

donateToReserves Exploit

Euler's `donateToReserves()` function reduced the attacker's collateral without a health-factor check afterward. Combined with a large dToken (debt token) position, this left the account in a technically insolvent state that the protocol's liquidation engine couldn't resolve correctly.

Step 3

Self-Liquidation

Attacker set up a second address as liquidator and self-liquidated at a discount, pocketing the liquidation bonus applied to the inflated position. This extracted real ETH, DAI, WBTC, USDC, and stETH from Euler's reserves.

Step 4

Partial Recovery

Euler deployed security researchers and negotiated on-chain. The attacker sent multiple messages via tx calldata. On March 25, the full $177M was returned in two tranches — DAI and ETH — following an ultimatum. The team later offered a $1M bounty to identify the attacker.

Key findings

Exploiter Address

0xb66c…95dbPrimary attacker wallet. Received all drained assets — DAI, WBTC, USDC, stETH, ETH — from Euler's reserve pools

Flash Loan Re-entrancySelf-Liquidation

Root Cause

donateToReserves() — missing health checkThe function reduced user collateral without calling checkAccountHealth() after the state update. Euler's audit missed this path because the function was added post-audit in a minor update.

Audit Miss

Funds Recovered

$177M returned — 90% recovery rateLargest voluntary return in DeFi history at the time. Attacker kept ~$20M; Euler compensated affected users via a governance snapshot proportional distribution.

Partial Recovery

Key Timeline

13 Mar exploit → 25 Mar return (12 days)Euler negotiated via on-chain messages. Attacker initially sent 100 ETH back as a test, then returned remaining DAI and ETH in two transactions on March 25.

Investigate your own incident

ChainHint traced the Euler Finance hack in minutes.
Use the same tool for your case.