{"id":46713,"date":"2023-03-16T05:09:38","date_gmt":"2023-03-16T09:09:38","guid":{"rendered":"https:\/\/coinscreed.com\/staging\/?p=46713"},"modified":"2023-03-16T05:09:42","modified_gmt":"2023-03-16T09:09:42","slug":"euler-finance-hacker-transfers-stolen-funds-to-crypto-mixer","status":"publish","type":"post","link":"https:\/\/coinscreed.com\/staging\/euler-finance-hacker-transfers-stolen-funds-to-crypto-mixer\/","title":{"rendered":"Euler finance hacker transfers stolen funds to crypto mixer"},"content":{"rendered":"\n<p><a href=\"https:\/\/coinscreed.com\/staging\/defi-lender-euler-finance-drained-of-197m-in-flash-loan-exploit.html\" target=\"_blank\" rel=\"noreferrer noopener\">Euler Finance hacker<\/a> has begun transferring assets to the cryptocurrency mixer Tornado Cash hours after a $1 million reward was offered for information leading to the perpetrator's identification.<\/p>\n\n\n\n<figure class=\"wp-block-image aligncenter size-full\"><img fetchpriority=\"high\" decoding=\"async\" width=\"930\" height=\"482\" src=\"https:\/\/coinscreed.com\/staging\/wp-content\/uploads\/2023\/03\/image-39.png\" alt=\"Euler finance hacker transfers stolen funds to crypto mixer\" class=\"wp-image-46718\" srcset=\"https:\/\/coinscreed.com\/staging\/wp-content\/uploads\/2023\/03\/image-39.png 930w, https:\/\/coinscreed.com\/staging\/wp-content\/uploads\/2023\/03\/image-39-300x155.png 300w, https:\/\/coinscreed.com\/staging\/wp-content\/uploads\/2023\/03\/image-39-768x398.png 768w, https:\/\/coinscreed.com\/staging\/wp-content\/uploads\/2023\/03\/image-39-150x78.png 150w, https:\/\/coinscreed.com\/staging\/wp-content\/uploads\/2023\/03\/image-39-750x389.png 750w\" sizes=\"(max-width: 930px) 100vw, 930px\" \/><figcaption class=\"wp-element-caption\">Euler finance hacker transfers stolen funds to crypto mixer<\/figcaption><\/figure>\n\n\n\n<p>PeckShield, a blockchain analytics company, tweeted on March 16 that the perpetrator of the flash loan attack on Ethereum's noncustodial lending protocol was &#8220;on the run.&#8221;<\/p>\n\n\n\n<p>The hacker moved one thousand Ether, or around $1.65 million, through the authorized <a href=\"https:\/\/coinscreed.com\/staging\/cryptocurrency-mixer-tornado-cash-open-sources-ui-code.html\" target=\"_blank\" rel=\"noreferrer noopener\">cryptocurrency mixer<\/a> Tornado Cash.<\/p>\n\n\n\n<figure class=\"wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter\"><div class=\"wp-block-embed__wrapper\">\n<blockquote class=\"twitter-tweet\" data-width=\"550\" data-dnt=\"true\"><p lang=\"en\" dir=\"ltr\"><a href=\"https:\/\/twitter.com\/hashtag\/PeckShieldAlert?src=hash&ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener\">#PeckShieldAlert<span class=\"wpil-link-icon\" title=\"Link goes to external site.\" style=\"margin: 0 0 0 5px;\"><svg width=\"24\" height=\"24\" style=\"height:16px; width:16px; fill:#000000; stroke:#000000; display:inline-block;\" viewBox=\"0 0 24 24\" version=\"1.1\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" xmlns:svg=\"http:\/\/www.w3.org\/2000\/svg\"><g id=\"wpil-svg-outbound-7-icon-path\" fill=\"none\" clip-path=\"url(#clip0_31_188)\">\r\n                            <path d=\"M9.16724 14.8891L20.1672 3.88908\" stroke-linecap=\"round\"\/>\r\n                            <path d=\"M13.4497 3.53554L20.5208 3.53554L20.5208 10.6066\" stroke-linecap=\"round\" stroke-linejoin=\"round\"\/>\r\n                            <path d=\"M17.5 13.5L17.5 16.26C17.5 17.4179 17.5 17.9968 17.2675 18.4359C17.0799 18.7902 16.7902 19.0799 16.4359 19.2675C15.9968 19.5 15.4179 19.5 14.26 19.5L7.74 19.5C6.58213 19.5 6.0032 19.5 5.56414 19.2675C5.20983 19.0799 4.92007 18.7902 4.73247 18.4359C4.5 17.9968 4.5 17.4179 4.5 16.26L4.5 9.74C4.5 8.58213 4.5 8.0032 4.73247 7.56414C4.92007 7.20983 5.20982 6.92007 5.56414 6.73247C6.0032 6.5 6.58213 6.5 7.74 6.5L11 6.5\" stroke-linecap=\"round\"\/>\r\n                        <\/g>\r\n                        <defs>\r\n                            <clipPath id=\"clip0_31_188\">\r\n                                <rect fill=\"white\" height=\"24\" width=\"24\"\/>\r\n                            <\/clipPath>\r\n                        <\/defs><\/svg><\/span><\/a> <a href=\"https:\/\/twitter.com\/eulerfinance?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener\">@eulerfinance<span class=\"wpil-link-icon\" title=\"Link goes to external site.\" style=\"margin: 0 0 0 5px;\"><svg width=\"24\" height=\"24\" style=\"height:16px; width:16px; fill:#000000; stroke:#000000; display:inline-block;\" viewBox=\"0 0 24 24\" version=\"1.1\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" xmlns:svg=\"http:\/\/www.w3.org\/2000\/svg\"><use href=\"#wpil-svg-outbound-7-icon-path\"><\/use><\/svg><\/span><\/a> exploiter on the move<br>~1,000 <a href=\"https:\/\/twitter.com\/search?q=%24ETH&src=ctag&ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener\">$ETH<span class=\"wpil-link-icon\" title=\"Link goes to external site.\" style=\"margin: 0 0 0 5px;\"><svg width=\"24\" height=\"24\" style=\"height:16px; width:16px; fill:#000000; stroke:#000000; display:inline-block;\" viewBox=\"0 0 24 24\" version=\"1.1\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" xmlns:svg=\"http:\/\/www.w3.org\/2000\/svg\"><use href=\"#wpil-svg-outbound-7-icon-path\"><\/use><\/svg><\/span><\/a> into Tornado Cash through intermediary address 0xc66d&#8230;c9a<a href=\"https:\/\/t.co\/LAkY66YpoF\" target=\"_blank\">https:\/\/t.co\/LAkY66YpoF<span class=\"wpil-link-icon\" title=\"Link goes to external site.\" style=\"margin: 0 0 0 5px;\"><svg width=\"24\" height=\"24\" style=\"height:16px; width:16px; fill:#000000; stroke:#000000; display:inline-block;\" viewBox=\"0 0 24 24\" version=\"1.1\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" xmlns:svg=\"http:\/\/www.w3.org\/2000\/svg\"><use href=\"#wpil-svg-outbound-7-icon-path\"><\/use><\/svg><\/span><\/a> <a href=\"https:\/\/t.co\/0XhQV1nbgn\" target=\"_blank\">pic.twitter.com\/0XhQV1nbgn<span class=\"wpil-link-icon\" title=\"Link goes to external site.\" style=\"margin: 0 0 0 5px;\"><svg width=\"24\" height=\"24\" style=\"height:16px; width:16px; fill:#000000; stroke:#000000; display:inline-block;\" viewBox=\"0 0 24 24\" version=\"1.1\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" xmlns:svg=\"http:\/\/www.w3.org\/2000\/svg\"><use href=\"#wpil-svg-outbound-7-icon-path\"><\/use><\/svg><\/span><\/a><\/p>&mdash; PeckShieldAlert (@PeckShieldAlert) <a href=\"https:\/\/twitter.com\/PeckShieldAlert\/status\/1636181545345228800?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener\">March 16, 2023<span class=\"wpil-link-icon\" title=\"Link goes to external site.\" style=\"margin: 0 0 0 5px;\"><svg width=\"24\" height=\"24\" style=\"height:16px; width:16px; fill:#000000; stroke:#000000; display:inline-block;\" viewBox=\"0 0 24 24\" version=\"1.1\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" xmlns:svg=\"http:\/\/www.w3.org\/2000\/svg\"><use href=\"#wpil-svg-outbound-7-icon-path\"><\/use><\/svg><\/span><\/a><\/blockquote><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script>\n<\/div><\/figure>\n\n\n\n<p>That comes only hours after Euler Laboratories posted a $1 million prize for information leading to &#8220;the arrest of the Euler protocol attacker and the restitution of the stolen monies.&#8221;<\/p>\n\n\n\n<p>A day ago, Euler issued an on-chain message to the exploiter's address, threatening to launch a bounty &#8220;that leads to your arrest and the recovery of all monies&#8221; if 90% of the stolen coins were not returned within 24 hours.<\/p>\n\n\n\n<p>The transfer of cash to the cryptocurrency mixer may imply that the hacker remains unmoved by <a href=\"https:\/\/www.google.com\/search?q=Euler+finance+hacker+transfers+stolen+funds+to+crypto+mixer&rlz=1C1SQJL_enNG889NG889&oq=Euler+finance+hacker+transfers+stolen+funds+to+crypto+mixer&aqs=chrome..69i57j0i546l2.1053j0j9&sourceid=chrome&ie=UTF-8\" target=\"_blank\" rel=\"noreferrer noopener\">Euler's amnesty offer<span class=\"wpil-link-icon\" title=\"Link goes to external site.\" style=\"margin: 0 0 0 5px;\"><svg width=\"24\" height=\"24\" style=\"height:16px; width:16px; fill:#000000; stroke:#000000; display:inline-block;\" viewBox=\"0 0 24 24\" version=\"1.1\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" xmlns:svg=\"http:\/\/www.w3.org\/2000\/svg\"><use href=\"#wpil-svg-outbound-7-icon-path\"><\/use><\/svg><\/span><\/a>.<\/p>\n\n\n\n<p>Peckshield discovered that about 100 ETH, valued at $165,202 at the time of writing, were sent to a wallet address that likely belongs to one of the victims. An earlier on-chain message published from the wallet's address appealed to the attacker to return their &#8220;life savings.&#8221;<\/p>\n\n\n\n<figure class=\"wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter\"><div class=\"wp-block-embed__wrapper\">\n<blockquote class=\"twitter-tweet\" data-width=\"550\" data-dnt=\"true\"><p lang=\"en\" dir=\"ltr\">WOW!<a href=\"https:\/\/twitter.com\/eulerfinance?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener\">@eulerfinance<span class=\"wpil-link-icon\" title=\"Link goes to external site.\" style=\"margin: 0 0 0 5px;\"><svg width=\"24\" height=\"24\" style=\"height:16px; width:16px; fill:#000000; stroke:#000000; display:inline-block;\" viewBox=\"0 0 24 24\" version=\"1.1\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" xmlns:svg=\"http:\/\/www.w3.org\/2000\/svg\"><use href=\"#wpil-svg-outbound-7-icon-path\"><\/use><\/svg><\/span><\/a> Exploiter returned 100 <a href=\"https:\/\/twitter.com\/search?q=%24ETH&src=ctag&ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener\">$ETH<span class=\"wpil-link-icon\" title=\"Link goes to external site.\" style=\"margin: 0 0 0 5px;\"><svg width=\"24\" height=\"24\" style=\"height:16px; width:16px; fill:#000000; stroke:#000000; display:inline-block;\" viewBox=\"0 0 24 24\" version=\"1.1\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" xmlns:svg=\"http:\/\/www.w3.org\/2000\/svg\"><use href=\"#wpil-svg-outbound-7-icon-path\"><\/use><\/svg><\/span><\/a> to some guy who begged him for the money back as it was his life savings<a href=\"https:\/\/t.co\/Gz9aCUZB0H\" target=\"_blank\">https:\/\/t.co\/Gz9aCUZB0H<span class=\"wpil-link-icon\" title=\"Link goes to external site.\" style=\"margin: 0 0 0 5px;\"><svg width=\"24\" height=\"24\" style=\"height:16px; width:16px; fill:#000000; stroke:#000000; display:inline-block;\" viewBox=\"0 0 24 24\" version=\"1.1\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" xmlns:svg=\"http:\/\/www.w3.org\/2000\/svg\"><use href=\"#wpil-svg-outbound-7-icon-path\"><\/use><\/svg><\/span><\/a> <a href=\"https:\/\/t.co\/DhZBenqtuS\" target=\"_blank\">pic.twitter.com\/DhZBenqtuS<span class=\"wpil-link-icon\" title=\"Link goes to external site.\" style=\"margin: 0 0 0 5px;\"><svg width=\"24\" height=\"24\" style=\"height:16px; width:16px; fill:#000000; stroke:#000000; display:inline-block;\" viewBox=\"0 0 24 24\" version=\"1.1\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" xmlns:svg=\"http:\/\/www.w3.org\/2000\/svg\"><use href=\"#wpil-svg-outbound-7-icon-path\"><\/use><\/svg><\/span><\/a><\/p>&mdash; Wazz (@WazzCrypto) <a href=\"https:\/\/twitter.com\/WazzCrypto\/status\/1636182927410180097?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener\">March 16, 2023<span class=\"wpil-link-icon\" title=\"Link goes to external site.\" style=\"margin: 0 0 0 5px;\"><svg width=\"24\" height=\"24\" style=\"height:16px; width:16px; fill:#000000; stroke:#000000; display:inline-block;\" viewBox=\"0 0 24 24\" version=\"1.1\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" xmlns:svg=\"http:\/\/www.w3.org\/2000\/svg\"><use href=\"#wpil-svg-outbound-7-icon-path\"><\/use><\/svg><\/span><\/a><\/blockquote><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script>\n<\/div><\/figure>\n\n\n\n<p>This prompted a flood of further victims to submit messages to the address in the hopes of receiving their monies back.<\/p>\n\n\n\n<p>One message indicated that they were &#8220;twenty-six families from jobless rural areas&#8221; who had lost &#8220;one million USDT in total,&#8221; adding that their portion of the stolen monies represented &#8220;decades of hard labor in factories.&#8221;<\/p>\n\n\n\n<p>Another potential victim sent the attacker a note thanking them for their &#8220;great victory&#8221; and stating they had invested &#8220;desperately needed&#8221; monies for a property in Germany.<\/p>\n\n\n\n<p><em>\u201cMy wife is going to kill me if we can\u2019t afford our house [&#8230;] Is there any way [sic] you can help me? I have no idea what to tell my wife,\u201d they wrote.<\/em><\/p>\n\n\n\n<p>The $196 million stolen from Euler consisted of Dai, USD Coin, staked ETH, and <a href=\"https:\/\/coinscreed.com\/staging\/wrapped-bitcoin-supply-drops-to-negative-after-11500-token-burn.html\" target=\"_blank\" rel=\"noreferrer noopener\">wrapped Bitcoin<\/a>, according to on-chain statistics (WBTC).<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Euler Finance hacker has begun transferring assets to the cryptocurrency mixer Tornado Cash hours after a $1 million reward was offered for information leading to the perpetrator&#8217;s identification. PeckShield, a blockchain analytics company, tweeted on March 16 that the perpetrator of the flash loan attack on Ethereum&#8217;s noncustodial lending protocol was &#8220;on the run.&#8221; The [&hellip;]<\/p>\n","protected":false},"author":12,"featured_media":46718,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[11476],"tags":[13793,13744,1496,10782],"class_list":["post-46713","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-hacks-and-scams","tag-crypto-mixer","tag-euler-finance","tag-hack","tag-tornado-cash-2"],"jetpack_featured_media_url":"https:\/\/coinscreed.com\/staging\/wp-content\/uploads\/2023\/03\/image-39.png","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/posts\/46713","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/users\/12"}],"replies":[{"embeddable":true,"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/comments?post=46713"}],"version-history":[{"count":0,"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/posts\/46713\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/media\/46718"}],"wp:attachment":[{"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/media?parent=46713"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/categories?post=46713"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/tags?post=46713"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}