Euler Finance hacked for over $195M in a flash loan attack

Ethereum-based noncustodial lending protocol Eurler finance faced a flash loan attack on March 13, with the attacker managing to steal millions in Dai (DAI), USD Coin (USDC), staked Ether (StETH) and wrapped Bitcoin (WBTC).

According to on-chain data, as per the last update, the exploiter carried out multiple transactions, stealing nearly $196 million. The ongoing attack has already become the largest hack of 2023. The breakdown of stolen funds is as follows: 

According to another crypto analytic firm Meta Seluth, the attack correlates with the deflation attack one month ago. The attacker used a multichain bridge to transfer the funds from the BNB Smart Chain (BSC) to Ethereum and launched the attack today.

Euler Finance acknowledged the exploit and said they are currently working with security professionals and law enforcement to resolve the issue.

We are aware and our team is currently working with security professionals and law enforcement. We will release further information as soon as we have it. https://t.co/bjm6xyYcxf

— Euler Labs (@eulerfinance) March 13, 2023

ZachXBT, another prominent on-chain sleuth, pointed out that the movement of funds and the nature of the attack seems quite similar to black hats that exploited a BSC-based protocol last month. After exploiting a protocol on BSC a few weeks ago, the funds were deposited to the crypto mixer, Tornado Cash.

Euler Finance raised $32 million in a funding round last year that saw participation from FTX, Coinbase, Jump, Jane Street and Uniswap.

Euler Finance became quite popular for offering liquid staking derivatives (LSDs) services. LSDs are a relatively new type of token that enable stakers to augment potential returns by unlocking liquidity for staked cryptocurrency, such as Ether (ETH). Currently, LSDs make up to 20% of total value locked in centralized finance protocols.

This is a developing story, and further information will be added as it becomes available.