In a sweet turn of events, Euler Labs managed to recover the money stolen from the Euler protocol in a flash loan attack on March 13th. On Monday morning, the hacker responsible for the $197 million exploit sent the remaining sum of about $19 million worth of ether and about $12 million in DAI.
The attacker had already sent 51,000 ether over the previous weekend and 7,000 ether more last Tuesday. He then assured in an encoded blockchain message that “the rest of the money will be returned ASAP,” clarifying that safety issues were the reason for the delay. Today, Euler Labs posted on Twitter that “all of the recoverable funds” have been paid back.
After the hack, Euler Labs offered the attacker a 10% “remuneration” for returning the money within 24 hours. Otherwise, the company threatened to announce a $1 million reward for information leading to the hacker’s arrest – which it did. Due to a sudden change of heart or perhaps other, more down-to-earth reasons, the exploiter – who identified himself as “Jacob” but also used the “we” pronoun in earlier messages – decided to cooperate. In one of the blockchain messages, he admitted he “really fucked up” and claimed he “didn’t mean that.”
The influx of goodwill may not save Jacob from the long arm of the law. After the exploit, the hacker sent 100 ETH to the wallet controlled by Lazarus Group, a North Korea-sponsored cybercrime group, thus violating international sanctions. This risky move may set Jacob back a few million dollars or a few years in prison.
