First thought to be North Korean hackers, thieves returned $5.4 million worth of stolen Ether — followed by a message saying they "have no intention of keeping what is not ours."
Listen to the CoinMarketRecap podcast on Apple Podcasts, Spotify and Google Podcasts
The hack of crypto lender Euler Finance seems not to have been North Korean hackers after all.
On Saturday, they sent about 3,000 ETH worth $5.4 million back to Euler Labs.
"We want to make this easy on all those affected. No intention of keeping what is not ours. Setting up secure communication. Let us come to an agreement."
If the funds are returned, it won't be the biggest such turnaround.
A Bounty and a Misdirection
But Euler may just be getting lucky.
Having first offered to let the hackers keep $20 million and avoid prosecution if they returned the rest within 24 hours, Euler on March 15 issued a bounty:
"Today the Euler Foundation is launching a $1 million reward in the hope that this provides additional incentive for information that leads to the Euler protocol attacker's arrest and the return of all funds extracted by the attacker."
That was followed by news that $170,000 of the Ether stolen had been sent to a wallet address that had received funds from the Poly Network hack. And, some of the funds used to launch the attack had been run through the Tornado Cash mixing service that was placed under U.S. sanctions after extensive use by the Lazarus Group.
That news, supplied by blockchain intelligence firm Chainalysis, suggested the North Koreans were responsible.
But, citing the small size of the transaction, Chainalysis warned that "it's possible that this movement of funds was an attempt at misdirection by another hacking group."
Which appears to have been the case.
While Poly Network's hacker apparently began working with the project as a security consultant, it's worth noting that the Euler Labs offer of no prosecution won't mean much.
For another, funds used in the attack came through Tornado Cash after it had been placed under sanctions by the Treasury Department — a violation that comes with potentially very steep penalties of its own.