The hacker behind the attack on decentralized finance (DeFi) protocol Euler Finance has started returning the $197 million stolen from the lending and borrowing platform earlier this week. The stolen assets comprise $8.7 million in DAI, $18.5 million in Wrapped Bitcoin (WBTC), $135.8 million in Staked Ethereum (stETH), and $33.8 million in USDC stablecoin.
So far, the attacker has returned 3000 ether (ETH) worth around $5.4 million to the protocol. According to blockchain security company BlockSec, which detected the transaction, the funds were returned to the Euler Finance deployer’s address in three batches.
On-chain data shows that the exploiter still holds most of the crypto assets in his wallet. The marked address shows a balance of 81,951 ETH valued at around $148 million and $43 000 in DAI stablecoin.
Euler Offers $1 Million Bounty to Locate Hacker
While it is unclear whether the hacker will return the remaining funds, the protocol had earlier opened on-chain communication with the cybercriminal in hopes that he would return the loot. However, the hacker was unresponsive and showed no interest in the proposal.
The DeFi protocol also demanded that the attacker returns 90% of the stolen assets within 24 hours to avoid jail time, or it would issue a bug bounty to track him down.
On March 15, the protocol launched a $1 million bounty reward to anyone with information on the attacker. The funds will be used to reward anyone who can provide Euler information to help locate the hacker.
Hacker Returns 100 Ether Back to Victim
Despite being hunted, the exploiter moved part of the stolen funds to the popular crypto mixer Tornado Cash, sanctioned last year by the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) for aiding money laundering activities.
The hacker transferred 100 ETH worth $1.6 million to Tornado a few days after the attack, representing the largest DeFi ecosystem exploit since the start of the year.
Shortly after moving the funds to the mixer, the thief also sent 100 ETH to one of the victims of the hack after the unnamed victim sent an on-chain message to the hacker pleading to return part of the stolen funds.
