Hacker Behind $200M Euler Finance Exploit Tells All
He stole $200 million in 2023's biggest hack. He gave it back. Now, he's ready to explain why for the first time.
In a matter of just 18 minutes, on March 13, 2023, a hacker drained nearly $200 million worth of cryptocurrency from popular lending platform Euler Finance in the largest heist of the year.
Just three weeks later, he reversed the transactions to return everything he stole.
For the first time since the hack, the man at the helm of the operation has come forward to explain his side of the events — and claims he never intended to keep the money at all. Coinage has spoken with the man who says he’s the hacker, a young Argentine by the name of Federico Jaime — a claim supported by other significant evidence. This is his story.
On a cool March night in Rome, around 3 a.m., Federico Jaime was standing outside a bar, waiting for a friend, and talking to God. The 19-year-old Argentinian had spent the past month searching for something, but he hadn’t found it yet. He wanted to know why.
“God, if all of my projects had [been] complete within a month, why [not] this time?” he thought to himself, looking up at the sky. “Why have you heard me before, but not now?” He wouldn’t get back to his hotel for another few hours.
When he finally made it home, sleep eluded him, as it often does. And so, he decided to work.
Almost immediately, perhaps prophetically, Federico’s prayer was answered. He found what he had been looking for: A vulnerability in the code of a cryptocurrency lending program. He immediately set to work on taking advantage of his discovery.
“When I work, I work like an artist, like a writer,” Federico would later tell me by phone in English, his second language. “For the muse to be awakened, being lacking in sleep is good.”
Federico wouldn’t sleep for the next two days. When he finally woke up, in an Italian hospital bed, he was $200 million richer — and felt like a curse had been branded on his back.
Now, three months after the hack, the hacker who says he's "Federico Jaime" is coming forward publicly for the first time to explain why he took the money and why, exactly 23 days later, he would give it all back.
[STORY CONTINUED AT COINAGE.MEDIA]
The world of crypto runs on transparency. Every transaction — sending money to a friend, buying an NFT, taking out a loan — is public, and transactions are irreversible. The applications that run on blockchains, known as smart contracts, are similarly public; anyone can examine the code for themselves.
As interest in crypto has exploded over the past few years, an entire industry of decentralized finance applications (“DeFi protocols,” to those in the space) has sprung up along with it, allowing crypto investors to swap tokens, take out loans, make levered bets on price movements, and earn interest. Around $45 billion in cryptocurrency is currently pledged to DeFi protocols; in Fall 2021, that figure surpassed $175 billion, or about as much as Morgan Stanley holds in deposits.
DeFi offers crypto fans exciting financial innovations befitting the breakneck pace and lax regulation of the crypto space. If you want to borrow $200 million dollars with no collateral, or speculate on “meme” cryptocurrencies like Dogecoin and Pepecoin, DeFi is the only place to do it.
Hackers, meanwhile, see DeFi as a wide array of digital bank vaults, each with a public blueprint, practically inviting someone to try their hand at a heist. According to crypto research firm Chainalysis, DeFi protocols have become the primary target of crypto hackers, who stole $2.2 billion from DeFi in 2021 and $3.1 billion in 2022, representing over 80% of all stolen crypto that year.
The most successful crypto hacker, by far, is the Lazarus Group, known to experts as North Korea’s incredibly efficient state-sanctioned hacking operation. Of the $1.7 billion Lazarus stole in 2022, $1.1 billion came from DeFi exploits. U.S. officials claim that half of the roughly $3 billion Lazarus has stolen thus far has gone directly into funding North Korea’s ballistic missile program.
Given an unending onslaught of attacks, DeFi protocols have responded by enlisting security firms to audit smart contracts, monitor threats, and even entice white-hat hackers (the kind that flag vulnerabilities to earn rewards, as opposed to black-hat hackers who leverage those vulnerabilities to steal for themselves). Yet sometimes, even well-audited DeFi protocols taking every precaution can still fall victim to a robust hacking operation. Sometimes, though, all it takes is one 19-year-old kid with God on his side…
Lovely one