Euler Finance Exploit (2023)
See the evidence before you trust the verdict.
Historical Investigation
This investigation covers the 2023-03-13 exploit and the recovery arc through 2023-04-04, when substantially all recoverable funds had been returned and Euler moved to a redemption plan for affected users. It is frozen at that point; the protocol's later products are out of scope.
On March 13, 2023, a single transaction sequence drained roughly $197M from Euler Finance - then, over three weeks of on-chain negotiation, nearly all of it came back. The root cause was not exotic: a governance-approved upgrade added a donation function that skipped the health check every other path enforced, and an attacker used the protocol's own liquidation discount against it. Euler had been audited repeatedly; the vulnerable function shipped after those audits. This investigation matters because it demonstrates three things at once: upgrades reopen closed audits, composability spreads a protocol's failure to its integrators within one block, and recovery-by-negotiation is an exception you cannot price in.
Confidence per domain, not a single score.
Incident
Attribution
Loss
Recovery
How the incident unfolded
2022 - early 2023
Audited core; upgrade adds the flaw
Euler operates with multiple audits and an active bounty program. Governance proposal eIP-14 later introduces donateToReserves - without the account health check every other balance-changing path enforces. The audited protocol and the deployed protocol quietly diverge.
Governance record; public code diff (verified in evidence table)
March 13, 2023
The exploit: donate, default, self-liquidate
Funded by a flash loan, the attacker leverages a position, donates eTokens to reserves to manufacture insolvency, and self-liquidates at the protocol discount - repeated across the DAI, WBTC, stETH, and USDC markets for ~$197M. Integrators holding deposits in Euler are hit in the same block.
On-chain transaction traces (verified in evidence table)
March 14-16, 2023
Ultimatum and first movements
Part of the proceeds moves, including mixer deposits. Euler Labs issues public terms: return 90% within the deadline or a $1M bounty goes on the attacker's identification. On-chain messages open a negotiation channel.
On-chain transfers and messages; Euler public statements
Late March 2023
Returns begin in tranches
The attacker starts returning funds in large tranches to the Euler DAO, accompanied by on-chain messages including an apology. The negotiation is conducted entirely in public, on-chain.
On-chain transfers to Euler DAO treasury
April 3-4, 2023
Substantially full recovery; redemption plan
Euler announces that all recoverable funds have been returned - one of the largest full recoveries in exploit history - and moves to a redemption program for affected users. The mixer-routed portion remains outside the returns.
Euler announcement; on-chain treasury state
What the evidence shows
Root cause
donateToReserves missing health check
Introduced by governance upgrade eIP-14 after the protocol's audits; confirmed by public code diff and post-mortems.
Scale
~$197M across four markets
DAI, WBTC, stETH, and USDC markets drained in one transaction sequence. Total and per-market USD allocation corroborated by Euler post-mortem and independent security analyses (BlockSec, Certik); native amounts and per-market tx hashes pending on-chain reconstruction.
Amplifier
Flash loan (borrowed capital)
A flash loan funded the position. It amplified the exploit; it was not the vulnerability.
Attribution
Pseudonymous attacker
Communicated via on-chain messages during negotiation. No verified real-world identity.
Recovery
Substantially all funds returned
Progressive on-chain returns to the Euler DAO, completing 2023-04-03/04. A portion moved to a mixer early on and stayed out.
Downstream exposure
Integrators lost pooled deposits
Angle, Balancer boosted pools, Idle, Yearn strategies and others held deposits in Euler. Exposure documented per protocol; amounts marked approximate.
What XemaS found
Euler was a permissionless lending protocol with a strong security reputation: multiple audits, an active bug bounty, and a design that priced risk per asset. The vulnerability did not ship in that audited core. It arrived later, in governance proposal eIP-14, which added donateToReserves - a function letting a user donate their eTokens to protocol reserves. Every other balance-changing path in Euler ended with an account health check. This one did not.
The attack used the protocol's own mechanics end to end. Funded by a flash loan, the attacker deposited into a market, leveraged up using Euler's native loop (minting far more eTokens and dTokens than the collateral behind them), then donated a large block of eTokens to reserves. The donation destroyed their own collateral without touching their debt - manufacturing, in one call, a massively insolvent account. A second attacker account then liquidated the first at the protocol's liquidation discount, acquiring the underlying at a steep haircut. Repeated across the DAI, WBTC, stETH, and USDC markets, the sequence extracted roughly $197M.
What followed is the unusual part. After early movements - including a portion sent through a mixer - the attacker began communicating through on-chain messages. Euler Labs offered terms publicly: return 90% within a deadline or face a $1M bounty on identification. Over the following three weeks the attacker returned the funds in tranches, with an on-chain apology, completing in early April. Euler subsequently ran a redemption program for affected users. Recovery this complete is an outlier in exploit history - a fact that belongs in the record precisely because it cannot be relied upon.
Where the value went
A round trip, which is what makes it rare. Value left the protocol's four largest markets in one sequence, sat in attacker-controlled addresses (minus a mixer-routed slice), and returned in negotiated tranches over three weeks. The permanent losses were the mixer portion and three weeks of frozen uncertainty for users and integrators.
| Step | Movement |
|---|---|
| 1 | MEV front-runner executes DAI exploit first (block 16817996) |
| 2 | Principal exploiter executes DAI, WBTC, stETH, USDC transactions from 08:56:35 UTC |
| 3 | Early movements include mixer deposits |
| 4 | Negotiated returns to Euler DAO in tranches |
Downstream impact
Euler Finance
All four major markets drained; protocol paused, later made users whole via the recovery and a redemption program. Euler v1 was subsequently wound down.
Angle Protocol
Reserves backing agEUR were deposited in Euler and caught in the exploit - a material share of its backing, recovered with the returns. Composability transmitted the loss with no flaw in Angle's own code.
Balancer (boosted pools)
bb-e-USD boosted pools routed idle liquidity into Euler for yield and were drained with it. Yield-routing integrations inherit the full risk of their destination.
Idle Finance / Yearn strategies
Yield strategies allocating to Euler were exposed and froze withdrawals pending the recovery. Same lesson at one more remove: depositors often did not know Euler was in their risk graph at all.
Who was involved
Attacker
Executed the exploit, moved a portion through a mixer, then negotiated and returned substantially all funds via on-chain messages and tranches. Identity unverified; on-chain conduct fully documented.
Euler Labs / Euler DAO
Protocol developer and treasury. Issued the ultimatum and bounty, received the returned tranches, and ran the redemption program. Attribution public and uncontested.
Integrator protocols (Angle, Balancer, Idle, Yearn)
Held user deposits inside Euler at exploit time; losses and recoveries flowed through them mechanically. Their exposure is the composability half of this investigation.
Why it matters
The protocol you deposited into on day one is not the protocol you hold today - upgrades change the attack surface after every audit you read. Deposit risk includes governance velocity: how much code changes, how often, and what review gates each change. Recovery here was negotiated, not guaranteed; size positions as if returns do not happen, because usually they do not.
Evidence table
| Fact | State |
|---|---|
| Vulnerable function shipped via governance upgrade (eIP-14) | VERIFIED |
| Missing account health check in donateToReserves | VERIFIED |
| First successful exploit: MEV front-run DAI transaction | VERIFIED |
| Flash loan used to fund the position | VERIFIED |
| Self-liquidation at protocol discount across four markets | VERIFIED |
| Total extracted ~$197M | PARTIAL |
| Portion of proceeds moved through a mixer | VERIFIED |
| Funds returned in tranches, completing 2023-04-03/04 | VERIFIED |
| Attacker real-world identity | UNVERIFIED |
What was not visible
Per-market USD amounts corroborated; tx hashes and native amounts pending
The ~$197M total and per-market USD split (DAI ~$8.8M, WBTC ~$18.5M, stETH ~$135.8M, USDC ~$33.8M) are corroborated by the Euler post-mortem and independent security analyses (BlockSec, Certik) and are carried as PARTIAL. Independent reconstruction of native token amounts and specific transaction hashes per market is pending; market states promote to VERIFIED when those are confirmed and the sum reconciles to ~$197M.
Attribution ends at pseudonymity
The attacker negotiated and apologized via on-chain messages. None of that establishes identity. The mixer-routed portion is unattributed by design.
Motive is not evidence
Why the funds were returned - bounty pressure, traceability, jurisdiction, conscience - is unknowable from the chain. This investigation records what moved and when, not why.
Downstream exposure is enumerated, not exhaustive
Major integrator losses (Angle, Balancer boosted pools, Idle, Yearn strategies) are documented; smaller or indirect exposures may not be fully captured.
What this incident teaches
An audit is a snapshot; upgrades restart the clock
The exploited function did not exist when the audits everyone cited were performed. A protocol's risk state is its current deployed code plus its governance velocity - "audited" without "at which version" is not a safety claim.
Invariants must hold on every path
One balance-changing function without the health check undid a protocol that enforced it everywhere else. Security properties enforced per-function instead of architecturally will eventually miss a path - and attackers enumerate paths.
Flash loans amplify; they do not cause
The vulnerability was exploitable with any capital. The flash loan set the scale, not the possibility. Treating flash-loan activity as the threat itself mistakes the amplifier for the flaw.
Your risk graph includes protocols you never chose
Angle, Balancer, Idle and Yearn depositors lost access to funds through an exploit in a protocol many of them had never interacted with directly. Yield routing silently extends your dependency graph - map where deposits actually sit, not where they were made.
Recovery is an anecdote, not a control
Nearly everything came back - through pseudonymous negotiation that no one could compel. The correct base rate for exploit recovery remains near zero. Plan and size accordingly.
Structurally related incidents
Relationships derived from shared taxonomy - mechanism, failure pattern, protocol family, and attribution class.
Scan any address with the same evidence engine
EVM, Solana, Bitcoin, and Tron. Every scan returns verified evidence, not a traffic-light score.
Scan a token or walletNo account required for a first scan.