Hackers War: Ronin Bridge Exploiter Tries To Swindle Euler Finance's Attacker

Alleged North Korean hackers, the malicious actors linked to the massive Ronin bridge hack last year, tried to swindle $200 million in cryptocurrency from the exploiter of Euler Finance, according to experts.

Earlier this week, malicious actors behind the nearly $200 million Euler Finance hack, moved 100 Ether (ETH) worth of stolen funds to a flagged address linked to North Korean hackers, who were believed to be responsible for the $625 million "Axie Infinity" Ronin bridge hack in 2022.

Interestingly, these Ronin bridge exploiters reportedly sent an on-chain note to the hacker of Euler Finance, asking it to decrypt an encrypted message.

However, crypto outlet Coindesk, which talked to experts about this, said that the message was nothing but a phishing scam malicious actors used to try and steal the credentials of Euler Finance's hacker's wallet.

This surprising turn of events, which showed an attempt by a crypto hacker to steal from another, spun a weave of confusion and alarm on crypto Twitter and Euler Finance, which, over the past days, had talked to the hackers over the return of the stolen funds.

Just a few minutes after the Ronin bridge exploiter's wallet sent a message to Euler Finance hackers' wallet, the company intervened and warned the firm's hackers to err on the side of caution about the message and said that the hackers should "return [the] funds."

Euler Finance's developers, in a separate message, asked its company's hackers, "not try to view that message under any circumstance" and added, "do not enter your private key anywhere."

The devs also reminded the exploiter that the message could also compromise the machine they are using. "Reminder that your machine may also be compromised," Euler Finance's developers noted.

Former Ethereum Foundation developer Hudson Jameson said that while the motive behind the message is unclear, it could be an attempt to see if Euler Finance's exploiter would fall for the ploy.

"In my opinion, it is unknown why they are asking, but it definitely could be an attempt to see if the Euler hacker falls for a phishing attempt," Jameson said.

Euler Finance, a permissionless borrowing and lending protocol on Ethereum, was drained of $197 million from an attack that used six flash loans and a vulnerability.

The attack was considered a major blow to the decentralized finance (DeFi) sector since the company is perceived as the next great building block in the industry after Aave and Compound.