British cryptocurrency startup Euler Labs has suffered a devastating cyberattack, allowing attackers to steal nearly $200 million from a DeFi lending protocol.
The company offers a DeFi protocol on Ethereum that it claims allows users to lend and borrow almost any crypto asset.
However, yesterday, hackers exploited a vulnerability in that code to steal USDC ($34.1 million), Dai ($8.8 million), Wrapped Bitcoin ($18.9 million), and staked Ether ($137.1 million). We were able to steal approximately $199 million in digital currency. According to blockchain analytics firm Elliptic:
“Flash loan attacks involve withdrawing large, short-term, unsecured crypto loans from DeFi services and using those large sums of money to manipulate the market or other DeFi services to your advantage.” The company explained.
“The proceeds of the attack have already been laundered through Tornado Cash, a decentralized mixer licensed by the U.S. government.”
Read more about recent cryptocurrency thefts here: Record $3.8 billion stolen via cryptocurrencies in 2022
According to Elliptic, the funds used to carry out the attack came from the Monero wallet. Monero is a private coin and there is no public ledger of transactions associated with it, but it is possible to track these funds using Elliptic’s investigative tools.
Euler Finance said it took immediate action to contain the attack and worked with blockchain intelligence companies Chainalysis and TRM Labs, as well as the Ethereum security community, to attempt to recover the stolen funds.
The startup also shared information with UK and US law enforcement agencies In addition, we contacted the attacker “To see if we can learn more about our options.”
Euler Labs was also quick to point out that auditors had failed to find any vulnerabilities in their previous analysis of the lending protocol.
“Euler Labs is working with various security groups to conduct audits of the Euler Finance protocol. The vulnerable code was reviewed and approved by an external audit, but no vulnerabilities were discovered as part of the audit. bottom.” said.
“This vulnerability remained on-chain for eight months before being exploited today, despite a $1 million bug bounty in place.”
