Ethereum-based lending protocol Euler Finance could be a step closer to recovering funds stolen in a $196 million flash loan attack last week, with private discussions now initiated with the exploiter.

As the industry reels from the shock of Euler Finance’s $197 million hack, new on-chain data reveals a transaction to a red-flagged North Korean address that threatens to open a can of worms.

Early in the morning of March 17, 2023, 100 ETH stolen in the Euler Finance hack moved to an address that previously received funds stolen in the Axie Infinity Ronin Bridge hack, which was carried out by the North Korean hacking syndicate Lazarus Group.

On March 13th, 2023, Euler Finance was attacked, and the attacker profited approximately 200 million US dollars.

The recent Euler Finance exploit is the largest attack in the crypto space in 2023. The incident occurred through a flash loan attack that led to the loss of almost $200 million in crypto assets. 

According to BlockSec, the Euler attacker 0xb66cd966670d962C227B3EABA30a872DbFb995db has begun to transfer funds to Euler Finance. As of press time, 3,000 ETH has been returned so far.

Lazarus Group was initially sanctioned by OFAC in 2019 and has been involved in several exploits. In addition to the $625 million exploit of Axie Infinity’s Ronin network, it was also behind last year’s $100 million Harmony bridge hack.

Euler (EUL) Finance exploiter sent 100 Ethereum (ETH) — worth $170,468 — to the Ronin Bridge exploiter on March 17.

According to PeckShield, the Euler Finance attacker began to transfer assets. 100 ETH has been transferred to the Ronin Bridge attacker.

On March 13th, 2023, the lending project, Euler Finance, on the Ethereum blockchain was attacked, and the attacker profited approximately 200 million US dollars. The SlowMist Security Team intervened and analyzed the situation promptly, and shared the results as follows.