Partnered With:

19-year-old Euler hacker hesitated for three weeks when faced with $200 million.

Read this article in 32 Minutes

I never intended to keep this $200 million. I just wanted time to protect myself, and the amount is too large for me to handle.

On March 13, 2023, in just 18 minutes, a hacker stole nearly $200 million worth of cryptocurrency from a popular lending platform, Euler Finance. This was the largest theft of the year. Just three weeks later, the hacker reversed the transaction and returned everything he had stolen.

Since the hacker incident occurred, the person in charge of the operation has come forward for the first time to explain his views on the incident, and claimed that he had no intention of keeping the money.

Coinage had a conversation with a man who claimed to be a hacker. He is a young Argentinean named Federico Jaime, which is supported by other important evidence. This is his story.

On a cool March night in Rome, at around 3am, Federico stood outside a bar waiting for his friends and talking to God. This 19-year-old Argentine had been searching for something for the past month, but he had not yet found it. He wanted to know why.

"Oh my, if I could finish all my projects within a month, why not this time?" He looked up at the sky and wondered, "Why can't they hear me now when they used to listen to me before?" He still had a few hours before he could return to the hotel.

When he finally returned home, he couldn't fall asleep, as usual. So he decided to go to work.

Federico's prayer was answered almost immediately, perhaps prophetically. He found what he had been searching for: a vulnerability in the code of a cryptocurrency lending program. He immediately set to work utilizing his discovery.

"When I work, I work like an artist or a writer," Federico said. Later, he told me over the phone in his second language, English, "Lack of sleep is a good thing to awaken the muse."

For the next two days, Federico couldn't sleep. When he finally woke up in an Italian hospital bed, his fortune had increased by $200 million, but he felt as though a curse had been branded onto his back.

The world of cryptocurrency relies on transparency. Every transaction - sending money to a friend, buying NFTs, taking out a loan - is public, and transactions are irreversible. Applications running on the blockchain (called smart contracts) are also public; anyone can inspect the code for themselves.

With the increasing interest in cryptocurrency over the past few years, the entire decentralized finance (DeFi) application industry has emerged, allowing cryptocurrency investors to exchange tokens, obtain loans, leverage price changes, and earn interest. Currently, about $45 billion in cryptocurrency is committed to DeFi protocols; by the fall of 2021, this number exceeded $175 billion, roughly equivalent to the total amount of deposits held by Morgan Stanley.

DeFi provides exciting financial innovations for cryptocurrency enthusiasts, in line with the rapid development and relaxed regulation of the cryptocurrency industry. If you want to borrow 200 million US dollars without collateral, or speculate on "meme" cryptocurrencies such as DOGE and PEPE, then DeFi is the only choice.

Meanwhile, hackers view DeFi as a variety of digital bank vaults, each with a public blueprint (open-source code), effectively inviting someone to try to rob them. According to cryptocurrency research firm Chainalysis, DeFi protocols have become the primary target of cryptocurrency hackers, who stole $2.2 billion from DeFi in 2021 and $3.1 billion in 2022, accounting for over 80% of the total stolen cryptocurrency that year.

So far, the most successful cryptocurrency hacker is the Lazarus Group, which in 2022 stole $1.7 billion, of which $1.1 billion came from DeFi vulnerabilities.

In the face of endless attacks, the response of DeFi protocols is to recruit security companies to audit smart contracts, monitor threats, and even lure white hat hackers (hackers who mark vulnerabilities to get rewards, rather than exploit them) to steal vulnerabilities. Even DeFi protocols that have undergone rigorous audits and taken all preventive measures may still fall victim to powerful hacker attacks, and sometimes the attacker is just a 19-year-old kid with God on his side.

All of this can be prevented with just one line of code.

Back at the hotel, as the sun rose over Rome, Federico began studying Euler Finance, a DeFi lending protocol developed by London-based startup Euler Labs. Euler allows its users to borrow up to ten times the value of their collateral; invest $10,000 and you can trade like you have $100,000. But cryptocurrencies are volatile, and if the price moves against you, your deposit may not be enough to ensure the redemption of your collateral. That's why every time a user interacts with Euler, the platform checks the health of their account, and if the health score is too low, it triggers an automatic liquidation.

But Federico saw something that didn't exist: a lack of health checks in a single function within a single Euler smart contract. In just a few hours of research, Federico discovered areas that had been overlooked by the Euler team and several independent smart contract auditors.

This is just divine inspiration. This is just awakening my muse," Federico said. "To be precise, after searching for what I was looking for for a month... I found it.

Federico He began planning his attack. After two days of non-stop programming on March 13th, he was almost ready to execute. The only problem was: he didn't know how to deploy the smart contract, nor did he know how much it would cost.

"I searched on Google, 'What is the cost of deploying a smart contract?' and I found... an article that says 'Anywhere from $5,000 to $50,000'."

Federico raised his voice in disbelief. "WTF."

However, Federico continued to move forward and eventually realized that the actual cost of deploying contracts was much lower. At this point, it had been several days since he last slept and he told me that he hadn't even considered the financial aspect. "I think this is an experiment. Just an experiment," he explained. "I'm not sure if it will work... I'm not sure if I can deploy smart contracts. I have more doubts than certainties."

"So I really underestimated this vulnerability and myself, because it eventually worked," he added.

On the morning of March 13, 2023, at 9:54 AM Italian time,

Federico

sits in front of his computer. In just 18 minutes, he launches an attack on the Euler Finance protocol and steals $197 million worth of cryptocurrency from three wallets. The stolen funds are eventually deposited into a single wallet - a virtual suitcase filled with stacks of hundred-dollar bills.

"First of all, I think this is so exciting. I cracked a huge protocol and then I thought, wow, $200 million. This is the curse on my back."

Federico Still unable to fall asleep, he had the hotel concierge call an ambulance.

The first person to discover the anomaly was a robot. Some encryption security companies provide real-time threat monitoring and alerts for DeFi projects. In the Euler hack, at least two security companies, Forta and Hypernative, received alerts before the attack began.

Unfortunately, for Euler Labs, who refused to comment on this article, the automatic alert is only issued a few minutes before the attack starts. For this London-based startup, it is still too early to secure their protocol. ("We usually predict the time of the attack to be between one minute and one hour," said Alex Behrens, marketing manager at Forta.)

On the morning of March 11th, Monday, at 8:59 AM UK time, blockchain security company PeckShield posted on social media, "Hey @eulerfinance: you might want to take a look," and linked to a page showing that a wallet had attacked Euler's DAI stablecoin supply, stealing over $8.7 million.

Then, everyone watched as Euler was repeatedly hit. Hackers stole $18.5 million worth of WBTC, then stole $116 million worth of stETH... In the end, the hackers profited $197 million, while Euler's entire reserve of 6 tokens became worthless.

At 9:56 am, Euler quoted PeckShield's message on social media, saying: "We know that our team is currently working with security professionals and law enforcement agencies. We will release further information as soon as we obtain it."

Because this is a cryptocurrency, everyone can see the funds in the hacker's wallet. By examining the wallet's transactions, security experts can reverse engineer the attack and ultimately discover the single vulnerability that led to the theft. However, because this is a cryptocurrency, Euler's team cannot associate the wallet with real-life identities or understand the hacker's intentions.

On March 13th, the final action of the hacker was to send 100 ETH (valued at $168,000 at the time) through Tornado Cash, a "mixing" transaction protocol on Ethereum that makes funds harder to trace. The wallet address then went silent.

At 10:47 pm that evening, the Euler team sent a message to the hacker wallet stating: "We understand that you are responsible for the attack on the Euler platform this morning. We are writing to inquire if you are willing to discuss any possible next steps with us." This tentative communication marks the beginning of a difficult three weeks for the Euler team.

At 9:22 pm the next day, the Euler team sent another message to the hacker's wallet, proposing to return 90% of the stolen funds within 24 hours - allowing the hacker to keep a bug bounty of $20 million in fact. Otherwise, Euler will offer a reward of $1 million to anyone who provides information leading to the hacker's arrest.

The hacker did not respond.

On the morning of March 15th at 11:20 am, the Euler team sent another message to the hacker wallet, reiterating their previous bug bounty proposal. The Euler team wrote: "Then the investigation can stop, and the focus can be shifted to distributing it back to protocol users without resorting to legal means."

At 10:06 pm that night, after the hackers remained silent, the Euler team announced a reward of $1 million for information leading to the arrest of the hackers and the recovery of the funds. The next day, Dr. Michael Bentley, co-founder and CEO of Euler, shared his response to the attack, stating that the past few days were the most difficult of his life and expressing his sorrow for the affected users.

"I had to sacrifice the time I spent with my newborn son," Bentley wrote on Twitter. "I will never forgive the attackers, but they can correct their mistake and return the funds to the EulerDAO Treasury as soon as possible."

Federico Jaime claims that he never intended to keep this money. "I knew from the beginning that $200 million is not a small amount, and it would cause huge damage to the DeFi community, which is not my goal."

We all want to know, even if it's just for a moment, whether Federico has ever thought about what 200 million dollars can buy, and imagined living in a mansion or on a yacht?

"Never, not at all, because I am an entrepreneur. I can legally and perfectly make money. I don't need to steal, and I have no reason to take someone else's money."

For most people, such comments would only elicit eye rolls. After all, the crypto community is not known for its humility. But I have seen photos of Federico traveling around Europe, staying in five-star hotels, and wearing designer streetwear. In our conversations over the phone and occasional text messages, I asked Federico, who will turn 20 this June, how he manages to sustain his lifestyle.

Federico grew up in Buenos Aires with his parents and sister. Inspired by his software engineer father, he learned programming at the age of 12 and sold his first program, a plugin for the video game "Minecraft," for $10,000 at the age of 14. "This meant freedom, because I no longer needed to ask my parents for money, they applauded me."

When he grew up, Federico turned to a new game, "GTA V", and developed an anti-cheat system for the custom multiplayer game server he ran as a die-hard fan of the game. "I found a memory read error. I saw that we could benefit from it," Federico said, adding that the software, FiveGuard, is now owned by someone else. "This is special because when you enter a game server with some unfair advantage, you will be immediately banned."

Federico had originally planned to attend law school in Argentina, but after graduating in 2020 and dealing with the COVID-19 pandemic (there were many restrictions and a long quarantine period in Buenos Aires), Federico decided to take a long break before starting university with his parents' permission.

Last October, Federico traveled to Rome. In December of last year, he allegedly targeted Buenbit, a cryptocurrency exchange platform operating in Argentina, Mexico, and Peru, and stole hundreds of thousands of dollars. Federico Ogue, CEO of Buenbit, classified this attack as fraud. News reports cited police sources as saying that the losses from this attack were $800,000, but Federico denied this figure.

Federico declined to comment on the details of the case, although he admitted that his target was Buenbit. He also claimed that many of the more sensational details in the media reports were either misleading or completely fabricated. The 20-year-old man insisted that he was innocent in this case and pointed out that he and his lawyer were in contact with Buenbit's team, hoping to resolve the matter as soon as possible.

And, just a few months later, Federico had a new concern, this time it was 200 million.

When the attack occurred, Euler Finance had up to 7,000 users. Two days later on March 15th, one of the victims decided to send a message to the hacker's wallet (Federico's wallet).

"Please consider returning 90%/80%. I am a user who only has 78 wstETH, which is my life savings deposited into Euler. I am not a whale or a millionaire." DL News confirmed that the user is a blockchain developer named Santiago Avalos from Argentina, who wrote, "You cannot imagine the chaos I am in right now, completely devastated... Your decision will relieve many affected people."

Avalos's life savings of 78 wstETH were worth over $140,000 at the time. Thirteen hours after sending the message, Federico responded, but not through text. Instead, for the first time since the hacker attack three days ago, Federico took action and sent 100 ETH to Avalos, worth about $27,000 more than what the victim lost in the Euler crash. Avalos returned the excess funds to Euler, saying, "I believe he may have been moved by my message."

"This is my sincere act," Federico said when talking about his motivation for returning the funds. "I was very generous at the time. Additionally, I later found out that this person... is also Argentinean and a Solidity developer," he added. "This is indeed a very interesting coincidence."

Federico has not completed the fund transfer yet. In addition, he has twice sent himself 1100 ETH through Tornado Cash, making his earnings nearly 2 million US dollars. When I asked him why, Federico told me, "I didn't think too much about it. I figured if they gave me a 10% bounty, that would be too much for me. I'll try to take 1% of it."

His next move is the most confusing one so far. Before 5am on March 17th, Federico sent another 100 ETH, this time to a notorious wallet that was responsible for one of the largest cryptocurrency hacks in history over a year ago - stealing over $600 million from the Ronin Bridge. Just a month later, the US Treasury Department's Office of Foreign Assets Control (OFAC) officially linked the Ronin Bridge vulnerability to the Lazarus Group in Korea.

However, when I asked him about this matter, his explanation shocked me. "I didn't even know it was North Korea. I never doubted it," he began. "The reason I sent 100 ETH to Ronin users was purely out of admiration... I wanted to express my admiration from white hat hackers to black hat hackers."

I was stunned, and Federico saw it too. "I know you didn't expect me to say this, but it's a fact," he replied. "I think this is the most important field in the world today, and Ronin hackers' attacks are an engineering behavior. In this sense, it is admirable... Demons can also be beautiful women."

On the second day, Federico began to return the funds, initially in three installments of 1000 ETH each, totaling approximately $5.4 million at the time. Then, his wallet went dormant again. Analysts were skeptical at the time about whether Euler could recover the remaining funds.

However, two days later, on March 20th, Federico sent his first message to the Euler team: "We hope to make it easy for all affected parties to cope. We have no intention of retaining anything that does not belong to us. Set up secure communication. Let's reach an agreement."

Federico acknowledges that this news is a bit late: "I was trying to decide whether it was a good idea to keep $20 million in my own hands...because it was offered to me by Euler," he said. "I wasn't really prepared, lacked experience, and was a newcomer...I didn't sleep for days, for weeks, but in the end, I knew I had to return it, I knew I didn't want to cause any harm to Euler's user base."

However, Federico still spent a lot of time returning the funds. On March 25th, around 3 pm, 81,953 ETH (approximately $143 million) appeared for the first time. Then on the 27th, $10 million worth of DAI followed. At 3 am on the 28th, Federico publicly apologized, saying, "I messed up. I didn't mean to, but I disrupted other people's money, other people's work, other people's lives... Please forgive me." However, some funds were still under his control at the time.

Finally, on April 3rd, the Euler team excitedly announced that after the last few transactions by the hacker, all "recoverable funds" had been returned. Euler also officially revoked the $1 million bounty on Federico's head. The return of the funds marks one of the most successful recoveries in DeFi history, and Federico breathed a sigh of relief as everything came to an end.

Then, two and a half months later, Federico's wallet became active again and sent a message to himself. The first one was on June 17th, with only two words: "Ben yre" - Buenos Aires. Seventeen minutes later, the wallet sent another message, also in Spanish, claiming to be an Argentine Peronist white hat hacker. The message advised other hackers to "not be foolish, not steal, and earn bounties."

At the end of the message, the wallet linked to an Instagram account - @federicojaimeok. I sent him a private message. We started talking on Instagram, where Federico's story has been archived since September 2022, and then we continued our conversation on Telegram. Everything this person told me during our conversation matched the information I had learned about Federico from other sources. Federico also provided me with his father's phone number, who confirmed his own identity and relationship with Federico, and provided me with additional information that matched what Federico had told me.

Federico told me that he decided to come forward not for his own benefit, but for the benefit of the DeFi community. "I want to encourage ethical hacking behavior, that's the main reason. I hope to make a statement and tell people to do the right thing."

Federico also hopes that Euler's strategy of negotiating with attackers will set a precedent for other parts of DeFi. He said: "I am confident that the hacker scene in the decentralized finance field will be different after the Euler hacker incident. I think this shows the importance of auditing and negotiating after a hack attack to the world."

Erin Plante, Vice President of Investigations at Chainalysis, said: "However, not everyone in the cryptocurrency industry is enthusiastic about bug bounties and hacker negotiations becoming the norm. Most DeFi hackers do not receive rewards of $100,000 or $500,000 from legitimate bug bounties, but often demand 50% or more of the stolen funds as commission, which is more like extortion."

Plante also pointed out that as law enforcement agencies become better at tracking illegal cryptocurrencies, hackers are finding it harder to cash in on their rewards. She said, "In this situation, coupled with the collective decrease in bounties across the entire industry, the incentives for hackers to engage in this work are expected to change."

Federico repeatedly insisted to me that his plan was to return the funds from the beginning. So why did it take him three weeks?

"I want to have time to protect myself and find safe ways, both legal and otherwise," he said.

Of course, some of Federico's claims cannot be verified. Federico told me that the design and implementation of the protocol were entirely his own work ("I did all of this myself"), although he occasionally received suggestions from a colleague, such as a list of DeFi protocols to study (which seems more like an attempt to conceal other people's involvement, as we cannot determine from the chain data we have who wrote the code).

We will never know if Federico would have kept the money if he had planned the attack better. He admitted to me that he regretted not considering the consequences, but he said he did it just to do the right thing. "I just didn't plan well enough, and the amount was too large for me to handle," he said.

Federico told me that he regrets the pain he brought to the Euler team. "My heart broke when I saw Michael Bentley's tweet saying he had to sacrifice time with his family," he said. When I asked him if he was worried about the impact of this attack on the future, he denied this concern. "I believe that legally, the Euler team will not retrospectively pursue me, as this would prevent future hackers from returning funds."

Euler Finance started compensating victims of the attack on April 12, which made them happy (and almost unbelievable). The impact of the vulnerability has spread to 11 other DeFi protocols. One of them (Yield Protocol) did not recover until June 27. Since the hacker attack, Euler Finance has been paralyzed .

Federico is still in Europe and describes his personal situation as "complicated", but he hopes to return to Buenos Aires soon to continue his studies. "Since the Euler hack, my life hasn't been as easy, which has left me feeling stressed."

I asked Federico if he thought God seemed to be answering his prayers and teaching him a lesson. "I think he's either playing games with me or testing me," he replied.

Federico is still undecided.

Welcome to join the official BlockBeats community:

Telegram Subscription Group: https://t.me/theblockbeats

Telegram Discussion Group: https://t.me/BlockBeats_App

Official Twitter Account: https://twitter.com/BlockBeatsAsia

#Euler #hackers

Correction/Report