{"id":46858,"date":"2023-03-19T09:23:40","date_gmt":"2023-03-19T13:23:40","guid":{"rendered":"https:\/\/coinscreed.com\/staging\/?p=46858"},"modified":"2023-03-19T09:45:08","modified_gmt":"2023-03-19T13:45:08","slug":"euler-finance-exploiter-gives-back-3000-eth-worth-5-4m","status":"publish","type":"post","link":"https:\/\/coinscreed.com\/staging\/euler-finance-exploiter-gives-back-3000-eth-worth-5-4m\/","title":{"rendered":"Euler Finance exploiter gives back 3,000 ETH worth $5.4m"},"content":{"rendered":"\n<p>Euler Finance received 3,000 ETH worth $5.4m back from the <a href=\"https:\/\/coinscreed.com\/staging\/defi-lender-euler-finance-drained-of-197m-in-flash-loan-exploit.html\" target=\"_blank\" rel=\"noreferrer noopener\">Euler Financial exploiter<\/a>, indicating a possible agreement between the platform and the hacker.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img fetchpriority=\"high\" decoding=\"async\" width=\"1024\" height=\"576\" src=\"https:\/\/coinscreed.com\/staging\/wp-content\/uploads\/2023\/03\/croc_1679174493785-1024x576.jpg\" alt=\"Euler Finance exploiter gives back 3,000 ETH worth $5.4m\" class=\"wp-image-46860\" srcset=\"https:\/\/coinscreed.com\/staging\/wp-content\/uploads\/2023\/03\/croc_1679174493785-1024x576.jpg 1024w, https:\/\/coinscreed.com\/staging\/wp-content\/uploads\/2023\/03\/croc_1679174493785-300x169.jpg 300w, https:\/\/coinscreed.com\/staging\/wp-content\/uploads\/2023\/03\/croc_1679174493785-768x432.jpg 768w, https:\/\/coinscreed.com\/staging\/wp-content\/uploads\/2023\/03\/croc_1679174493785-150x84.jpg 150w, https:\/\/coinscreed.com\/staging\/wp-content\/uploads\/2023\/03\/croc_1679174493785-750x422.jpg 750w, https:\/\/coinscreed.com\/staging\/wp-content\/uploads\/2023\/03\/croc_1679174493785-1140x641.jpg 1140w, https:\/\/coinscreed.com\/staging\/wp-content\/uploads\/2023\/03\/croc_1679174493785.jpg 1200w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\">Euler Finance exploiter gives back 3,000 ETH worth $5.4m<\/figcaption><\/figure>\n\n\n\n<p>On March 18, the Euler Finance exploiter sent around 3,000 ETH ($5.4m) to the deployer address of the site. PeckShield, a blockchain investigator, found three transactions that were used to transmit money.<\/p>\n\n\n\n<figure class=\"wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter\"><div class=\"wp-block-embed__wrapper\">\n<div class=\"embed-twitter\"><blockquote class=\"twitter-tweet\" data-width=\"550\" data-dnt=\"true\"><p lang=\"qme\" dir=\"ltr\">\ud83d\udc40 <a href=\"https:\/\/t.co\/4OBksAu9od\" target=\"_blank\">https:\/\/t.co\/4OBksAu9od<span class=\"wpil-link-icon\" title=\"Link goes to external site.\" style=\"margin: 0 0 0 5px;\"><svg width=\"24\" height=\"24\" style=\"height:16px; width:16px; fill:#000000; stroke:#000000; display:inline-block;\" viewBox=\"0 0 24 24\" version=\"1.1\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" xmlns:svg=\"http:\/\/www.w3.org\/2000\/svg\"><g id=\"wpil-svg-outbound-7-icon-path\" fill=\"none\" clip-path=\"url(#clip0_31_188)\">\r\n                            <path d=\"M9.16724 14.8891L20.1672 3.88908\" stroke-linecap=\"round\"\/>\r\n                            <path d=\"M13.4497 3.53554L20.5208 3.53554L20.5208 10.6066\" stroke-linecap=\"round\" stroke-linejoin=\"round\"\/>\r\n                            <path d=\"M17.5 13.5L17.5 16.26C17.5 17.4179 17.5 17.9968 17.2675 18.4359C17.0799 18.7902 16.7902 19.0799 16.4359 19.2675C15.9968 19.5 15.4179 19.5 14.26 19.5L7.74 19.5C6.58213 19.5 6.0032 19.5 5.56414 19.2675C5.20983 19.0799 4.92007 18.7902 4.73247 18.4359C4.5 17.9968 4.5 17.4179 4.5 16.26L4.5 9.74C4.5 8.58213 4.5 8.0032 4.73247 7.56414C4.92007 7.20983 5.20982 6.92007 5.56414 6.73247C6.0032 6.5 6.58213 6.5 7.74 6.5L11 6.5\" stroke-linecap=\"round\"\/>\r\n                        <\/g>\r\n                        <defs>\r\n                            <clipPath id=\"clip0_31_188\">\r\n                                <rect fill=\"white\" height=\"24\" width=\"24\"\/>\r\n                            <\/clipPath>\r\n                        <\/defs><\/svg><\/span><\/a> <a href=\"https:\/\/t.co\/Zb3MIyex2f\" target=\"_blank\">pic.twitter.com\/Zb3MIyex2f<span class=\"wpil-link-icon\" title=\"Link goes to external site.\" style=\"margin: 0 0 0 5px;\"><svg width=\"24\" height=\"24\" style=\"height:16px; width:16px; fill:#000000; stroke:#000000; display:inline-block;\" viewBox=\"0 0 24 24\" version=\"1.1\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" xmlns:svg=\"http:\/\/www.w3.org\/2000\/svg\"><use href=\"#wpil-svg-outbound-7-icon-path\"><\/use><\/svg><\/span><\/a><\/p>&mdash; PeckShield Inc. (@peckshield) <a href=\"https:\/\/twitter.com\/peckshield\/status\/1636985705858764800?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener\">March 18, 2023<span class=\"wpil-link-icon\" title=\"Link goes to external site.\" style=\"margin: 0 0 0 5px;\"><svg width=\"24\" height=\"24\" style=\"height:16px; width:16px; fill:#000000; stroke:#000000; display:inline-block;\" viewBox=\"0 0 24 24\" version=\"1.1\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" xmlns:svg=\"http:\/\/www.w3.org\/2000\/svg\"><use href=\"#wpil-svg-outbound-7-icon-path\"><\/use><\/svg><\/span><\/a><\/blockquote><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/div>\n<\/div><\/figure>\n\n\n\n<p>On March 13, Euler Financial was the target of a flash loan assault in which the hacker made off with $197 million. Four transactions totaling $136 million staked ether (stETH), $34 million USDC, $19 million wrapped bitcoin (WBTC), and $8.7 million DAI were used to steal the money.<\/p>\n\n\n\n<p>By using a flash loan to influence the protocol's internal marketplaces, the attacker depleted their financial resources.Eventually, the hacker sent $1.80 million worth of stolen funds\u2014or 1,100 ETH\u2014to the <a href=\"https:\/\/www.google.com\/search?q=Euler+Finance+exploiter+gives+back+3%2C000+ETH+worth+%245.4m&client=opera&sxsrf=AJOqlzVNv_p0UVAs1Nlef5EhOvZdUsrYWQ%3A1678828419725&ei=g-MQZO71K4mF9u8Ph5S2WA&ved=0ahUKEwiuw-Kcq9z9AhWJgv0HHQeKDQsQ4dUDCA4&uact=5&oq=Euler+Finance+exploiter+gives+back+3%2C000+ETH+worth+%245.4m&gs_lcp=Cgxnd3Mtd2l6LXNlcnAQAzIHCCMQ6gIQJzIHCCMQ6gIQJzIHCCMQ6gIQJzIHCCMQ6gIQJzIHCCMQ6gIQJzIHCCMQ6gIQJzIHCCMQ6gIQJzIHCCMQ6gIQJzIHCCMQ6gIQJzIHCCMQ6gIQJzINCAAQjwEQ6gIQtAIYATINCAAQjwEQ6gIQtAIYATINCAAQjwEQ6gIQtAIYATINCC4QjwEQ6gIQtAIYATINCAAQjwEQ6gIQtAIYATINCAAQjwEQ6gIQtAIYATINCC4QjwEQ6gIQtAIYATINCC4QjwEQ6gIQtAIYATINCAAQjwEQ6gIQtAIYATINCAAQjwEQ6gIQtAIYAUoECEEYAFCOCViOCWCoC2gCcAF4AIABAIgBAJIBAJgBAKABAaABArABFMABAdoBBggBEAEYCg&sclient=gws-wiz-serp\" target=\"_blank\" rel=\"noreferrer noopener\">cryptocurrency mixer Tornado Cash<span class=\"wpil-link-icon\" title=\"Link goes to external site.\" style=\"margin: 0 0 0 5px;\"><svg width=\"24\" height=\"24\" style=\"height:16px; width:16px; fill:#000000; stroke:#000000; display:inline-block;\" viewBox=\"0 0 24 24\" version=\"1.1\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" xmlns:svg=\"http:\/\/www.w3.org\/2000\/svg\"><use href=\"#wpil-svg-outbound-7-icon-path\"><\/use><\/svg><\/span><\/a>.<\/p>\n\n\n\n<p>On March 14, the protocol offered the exploiter a 10% prize in exchange for returning 90% of the stolen money. However, it issued a warning that it would provide a $1 million reward for information that would result in their capture and the recovery of all monies if the funds were not returned within 24 hours.<\/p>\n\n\n\n<p>Attacker transfers money to Lazarus Group, According to Lookonchain, the hacker delivered 100 ETH ($170,500) on March 17 to a wallet linked to the Lazarus Group's Ronin, a <a href=\"https:\/\/coinscreed.com\/staging\/north-korean-hacking-activity-ends-after-kyc-is-implemented.html\" target=\"_blank\" rel=\"noreferrer noopener\">North Korean hacking squad<\/a>. It is unknown if Lazarus Group is a complicit party or affiliated with the Euler Financial abuser.<\/p>\n\n\n\n<figure class=\"wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter\"><div class=\"wp-block-embed__wrapper\">\n<div class=\"embed-twitter\"><blockquote class=\"twitter-tweet\" data-width=\"550\" data-dnt=\"true\"><p lang=\"qme\" dir=\"ltr\"><a href=\"https:\/\/t.co\/f1Ba0Il3mG\" target=\"_blank\">https:\/\/t.co\/f1Ba0Il3mG<span class=\"wpil-link-icon\" title=\"Link goes to external site.\" style=\"margin: 0 0 0 5px;\"><svg width=\"24\" height=\"24\" style=\"height:16px; width:16px; fill:#000000; stroke:#000000; display:inline-block;\" viewBox=\"0 0 24 24\" version=\"1.1\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" xmlns:svg=\"http:\/\/www.w3.org\/2000\/svg\"><use href=\"#wpil-svg-outbound-7-icon-path\"><\/use><\/svg><\/span><\/a><\/p>&mdash; \ud83e\udee1 \u064b (@cryptyo) <a href=\"https:\/\/twitter.com\/cryptyo\/status\/1636986605784166404?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener\">March 18, 2023<span class=\"wpil-link-icon\" title=\"Link goes to external site.\" style=\"margin: 0 0 0 5px;\"><svg width=\"24\" height=\"24\" style=\"height:16px; width:16px; fill:#000000; stroke:#000000; display:inline-block;\" viewBox=\"0 0 24 24\" version=\"1.1\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" xmlns:svg=\"http:\/\/www.w3.org\/2000\/svg\"><use href=\"#wpil-svg-outbound-7-icon-path\"><\/use><\/svg><\/span><\/a><\/blockquote><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/div>\n<\/div><\/figure>\n\n\n\n<p>Lazarus Group was added to the list of entities with special designation by the <a href=\"https:\/\/coinscreed.com\/staging\/u-s-government-warns-crypto-against-russia.html\" target=\"_blank\" rel=\"noreferrer noopener\">U.S. Treasury Department<\/a> in April 2022.Unknown is if the attacker intends to return the remaining money.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Euler Finance received 3,000 ETH worth $5.4m back from the Euler Financial exploiter, indicating a possible agreement between the platform and the hacker. On March 18, the Euler Finance exploiter sent around 3,000 ETH ($5.4m) to the deployer address of the site. PeckShield, a blockchain investigator, found three transactions that were used to transmit money. [&hellip;]<\/p>\n","protected":false},"author":43,"featured_media":46860,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[11476],"tags":[13744,12002,12490],"class_list":["post-46858","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-hacks-and-scams","tag-euler-finance","tag-hacks","tag-scams-2"],"jetpack_featured_media_url":"https:\/\/coinscreed.com\/staging\/wp-content\/uploads\/2023\/03\/croc_1679174493785.jpg","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/posts\/46858","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/users\/43"}],"replies":[{"embeddable":true,"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/comments?post=46858"}],"version-history":[{"count":0,"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/posts\/46858\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/media\/46860"}],"wp:attachment":[{"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/media?parent=46858"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/categories?post=46858"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/coinscreed.com\/staging\/wp-json\/wp\/v2\/tags?post=46858"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}