Euler Finance hack
The Ethereum lending protocol Euler Finance lost about $197M in a March 2023 flash-loan attack exploiting a flawed 'donate' function. After weeks of on-chain negotiation, the attacker returned essentially all of the recoverable funds.
Also known as: Euler Finance, Euler
Summary
Euler Finance, a permissionless lending protocol on Ethereum, was exploited on March 13, 2023 for roughly $197 million in DAI, USDC, staked ETH, and wrapped BTC — the largest DeFi hack of the year to that point. Analysts said the attacker used flash loans to exploit a flaw in a donateToReserve function that allowed an account to be pushed into an unhealthy state and self-liquidated for profit. [1][2]
Recovery
Over the following weeks, the attacker — communicating via on-chain messages and identifying as "Jacob" — returned the funds in stages; with ETH's price rising during negotiations, the returned value reached about $240 million, and Euler said it had recovered all of the recoverable stolen assets. A small amount sent to Tornado Cash and to a North Korea-linked address was not recovered. [1][2]
Bracketed numbers refer to the numbered sources listed below.
Sources (2)
See also
World Liberty Financial (WLFI) — Justin Sun token freezeProjectsWLFI, a DeFi project linked to Donald Trump and his family, blacklisted/froze the wallet of major investor Justin Sun in Sept 2025 — ~540–595M unlocked WLFI tokens (~$107M) plus ~2.4B locked. Sun sued, alleging an undisclosed admin 'blacklist backdoor'; WLFI denied it and threatened a countersuit. The dispute is ongoing.
Gala Games exploitTokensOn May 20, 2024 an attacker abused a privileged minter account on the GALA token contract to mint 5 billion GALA (≈$200M+ nominal) and dumped ~600M of them for ~$22M of ETH before Gala froze the address. Gala Games called it an internal access-control failure; the attacker later returned the ~$22M.
This page was last updated on Jun 15, 2026. View revision history.
