Euler Finance, a DeFi lending protocol, was subject to an attack resulting in a loss of nearly $200 million across several transactions involving DAI, WBTC, sETH, and USDC, as reported by smart contract auditor BlockSec. The attacker used a flash loan to carry out the attack. Euler Finance has confirmed the incident and is working with security experts and law enforcement. Flash loans enable DeFi users to borrow millions without any collateral, but the loan must be repaid before the end of the transaction, or the smart contract undoes the transaction. Such loans have become a popular tool for attackers targeting decentralized systems, with previous attacks on Beanstalk and Inverse Finance resulting in multi-million dollar losses.
The attackers behind the Euler Finance exploit used a flash loan to manipulate the protocol into believing it held a lower amount of eToken than it actually did, triggering an on-chain liquidation when the amount of dToken exceeded the eToken held. The attackers borrowed over $30 million in DAI stablecoin using flash loans from Balancer and Aave, and sent $20 million to Euler. They then borrowed nearly $400 million worth of eDAI and dDAI from Euler, repaying part of the initial debt using the remaining funds, which caused the protocol to owe more to depositors than it held. DeFi exploits remain a significant issue in the industry, with Chainalysis reporting over $3 billion in losses from DeFi hacks and exploits in 2022.