Lazarus: North Korean hackers behind the DeFi attack on Euler?

$197 million was stolen from the Euler lending platform last week.

Last week, $197 million was stolen from the Euler lending platform. Blockchain data points to a connection with the Lazarus Group.

After last week saw $197 million stolen from the Euler lending platform, it seems the hackers want to strike a deal. "We want to make it easy for everyone affected. We don't intend to keep what isn't ours," the hackers said in a message they stopped in an Ethereum transaction. Earlier, the platform issued an ultimatum and offered a $1 million bounty. Euler responded to the offer to talk. In the coming days, both sides could settle.

Flash loan attack cripples Euler

In the Euler attack, a total of US$197 million in crypto was stolen — the worst DeFi hack this year so far. The "flash loan attack" exploited liquidity problems in the smart contract. A faulty swap of borrowed crypto assets into collateral occurred. By executing multiple transactions in sequence, the attacker could drain the deposited amount several times.

In exchange for the stolen tokens, Euler initially offered ten percent of the loot. The hacker did not respond, prompting Euler to offer a reward of $1 million for information. To cover their tracks, parts of the stolen money were sent to the crypto mixer Tornado Cash.

Connections to North Korea?

On-chain data now shows that 100 Ether from the Euler hack was sent to an address that previously received funds from the Ronin Bridge attack. In the March last year attack on the Ethereum sidechain, more than $600 million was stolen. Blockchain assessments revealed the attack was orchestrated by North Korea2s hacker collective Lazarus.

"This could also mean that the Euler Finance hack was carried out by the Lazarus Group," says the blockchain security firm Chainalysis. Whether there is a link to North Korea, however, is "not certain at this time."