The decentralized Finance (Defi) loan protocol Euler Finance became the victim of a flash chip borrowing attack on March 13, resulting in the largest login password hacking since 2023. Loan agreements lost nearly $197 million in damage and seriously affected 11 other Defi agreements.

On March 14, Euler released the latest news and informed customers that the vulnerable etoken control module had been deactivated to block savings and vulnerable donations.

The company believes that they collaborate with various security agencies and audit protocols, and that vulnerable code is reviewed and approved in external audits. As part of the audit, the vulnerability was not discovered.

The vulnerability lasted for August until it was exploited, although there was a $1 million vulnerability reward in time.

Sherlock, an auditor that has worked with Euler Finance in the past, verified the main causes of the vulnerabilities and assisted Euler in submitting claims. The audit agreement was followed by an online vote on the claim of $4.5 million, which was based on which a payment of $3.3 million was implemented on 14 March.

In the data analysis report, the audit working group described an important factor in exploiting the vulnerability: the lack of physical examination in the new feature "donateToReserve" added to EIP-14. However, the agreement stresses that even before EIP-14, attack was still technically possible.

Sherlock highlighted the omission of the Euler audit conducted by WatchPug in July 2022, which led to the key loophole in March 2023.

Euler also contacted leading on-chain analytics and blockchain security companies, such as TRM Labs, Chainanalysis and the broader ETH security community, to help them investigate and recover assets.

Euler announced that they are also trying to contact those responsible for the attack to learn more about the issue and to negotiate a reward for the recovery of stolen funds.