Euler Finance: US and UK law enforcement agencies have been notified that the corresponding vulnerability has been kept on the chain for eight months

The DeFi lending protocol Euler Finance released the latest progress update. It has prevented direct attacks by helping to disable the EToken module. At the same time, it has cooperated with TRM Labs, Chainalysis and the wider Ethereum security community to help investigate and recover funds. The team has also notified the United States and British law enforcement has shared information and attempted to contact those responsible for the attack. Additionally, Euler Finance said the attackers exploited vulnerable code that allowed it to create unsecured token debt positions by donating funds to the protocol’s reserves, enabling the attackers to liquidate those accounts and profit from liquidation bonuses. Euler Labs has previously cooperated with various security organizations to audit the Euler Finance protocol. Although the vulnerable code was reviewed and approved during the external audit, the vulnerability was not discovered as part of the audit, and the vulnerability is on-chain. It remained there for eight months and was not exploited until today, despite a $1 million bug bounty in that time.