Euler V1

On March 13, 2023, an attacker drained roughly $197 million from Euler Finance, a permissionless lending protocol on Ethereum, across four assets — staked-ETH derivatives, WBTC, USDC and DAI. The exploit did not touch a bridge, an oracle, or third-party code: it targeted a logic flaw inside Euler's own reserve-donation function, making it one of the larger pure protocol-logic hacks of that period (Chainalysis).

How the attack worked

Euler let borrowers hold leveraged, over-collateralized positions and, separately, let anyone "donate" their deposit tokens (eTokens) to the protocol's reserves — a goodwill feature with little obvious use, except one detail: it burned eTokens without touching the matching debt tokens (dTokens), and it skipped the solvency check ("health check") that every borrow, withdraw or transfer had to pass.

The attacker took a flash loan of about $30 million in DAI from Aave to bootstrap two linked contracts (Chainalysis). One built up a large eToken balance through leveraged borrowing; the attacker then called the donation function to erase that eToken balance while leaving the matching debt untouched, instantly turning a healthy-looking position into an insolvent one on paper — no collateral, real debt (Rekt). Because the donation function never called the health check, the transaction did not revert.

A second, attacker-controlled contract then liquidated that now-insolvent position. Euler's liquidation mechanism pays liquidators a discount on seized collateral to keep the protocol solvent — normally a safety feature, here a leak, since the internal accounting still recorded value to seize even though it had just been "donated" away moments earlier. Repeated across the WBTC, staked-ETH, USDC and DAI pools, this let the attacker walk away with real deposits belonging to other users, not just the borrowed capital. This is the mechanism our internal label "Flashloan Donate Function Logic Exploit" refers to; contemporary coverage more often called it a "donation attack" or a flash-loan attack on the reserve-donation function — same exploit, different names for the same missing check.

What happened after

Euler's TVL fell from roughly $264 million to about $10 million within hours (Rekt). On March 16 the team offered a $1 million bounty for information leading to the attacker's identification (DailyCoin); part of the stolen funds had already passed through Tornado Cash, and some moved through addresses previously linked to the Lazarus Group, briefly raising — then dropping — suspicion of state-linked involvement (Chainalysis). Sherlock, Euler's on-chain insurer, paid out $4.5 million in interim claims to affected users (Rekt).

Rather than disappearing, the attacker began returning funds in tranches from March 18, and on March 28 sent an apology through an on-chain message, signing it "Jacob" (DailyCoin), before a final transfer arrived on April 3–4, 2023. Euler Labs then stated that "all of the recoverable funds" had come back (Silicon Republic). Reporting on the precise final figure varies — see the discrepancy note on this incident — with some outlets tracing roughly $177 million actually transferred back to Euler's treasury after netting out the bounty the team had offered, against Euler's own framing of a full $197 million recovery (The Block). No arrest or prosecution tied to the case has been publicly confirmed in the sources reviewed. The protocol itself did not fold: development continued, and Euler later shipped a rebuilt architecture.

What this means

• Any function that changes a user's collateral or debt balance sits inside the solvency-check surface — not just borrow, withdraw and liquidate. A "donate to reserves" feature looks harmless until it is used to desynchronize collateral and debt accounting.
• The flash loan here was a capital amplifier, not the vulnerability itself. Framing this as a "flash-loan attack" obscures the real cause: the loan simply scaled a pre-existing logic gap to a size worth exploiting.
• Functions added after a protocol's original audit inherit none of that audit's coverage by default. Parameters and entry points bolted on later are a recurring location for under-tested logic across DeFi incidents.
• The near-full recovery here is the exception, not the norm, for DeFi hacks — it depended on the funds staying traceable and on a costly, uncertain negotiation. Protocol risk should not be priced assuming a hack gets reversed.