Euler Finance hack — March 2023

Euler Finance, an Ethereum lending protocol, lost about $197m on 13 March 2023 — the largest DeFi exploit of that year.

The flaw was in donateToReserves, which allowed a user to give away collateral without the protocol checking whether the account remained solvent afterwards. Using flash-loaned capital, the attacker deposited, leveraged up, donated enough collateral to make their own position unhealthy, and then liquidated it at a discount to themselves. The sequence was repeated across several pools.

What followed was unusual. Over the next three weeks, following public appeals and on-chain negotiation, the attacker returned the funds in stages, accompanied by messages of apology. Euler's own account of the recovery puts the total value returned at around $240m, since the assets had appreciated in the interim; the amount taken at the time of the exploit was about $197m, which is the figure recorded here.

Euler's write-up of the negotiation is one of the more detailed public accounts of how a protocol talks an attacker into returning money.