The person behind 2023’s Euler Finance hack has congratulated the Penpie exploiter after the latter moved the bulk of the funds they stole to Tornado Cash.

The Penpie thief transferred the money even as the decentralized finance (DeFi) platform pleaded for the funds to be returned in exchange for a bounty.

The $27M Penpie Protocol Hack

On Sep. 6, blockchain security company Peckshield made a post on X featuring the Euler Finance exploiter’s message to the Penpie protocol attacker that read:

“Good job bro. I didn’t see a hack like this for a while. I am happy you kept all the money and didn’t let these b*stards get back even one dollar of what you took. You won. They lost. Good job.”

Earlier this month, the decentralized protocol was attacked, and the culprits stole about $27 million worth of ether (ETH). Just 12 hours after the occurrence, the offender channeled $7 million through crypto mixer Tornado Cash.

According to Peckshield, the perpetrator recently transferred about $17 million in crypto to an intermediary address and subsequently laundered more than $13 million of the funds through the mixer. So far, the suspect has reportedly sent 9.6K ETH (about $23M) to Tornado Cash.

In the aftermath of the hack, the Penpie team halted withdrawals and deposits to investigate what happened and even reportedly went to Singapores Kampong Java Neighbourhood Police Centre to report the case.

Crypto Hacks on the Rise

In 2023, Euler Finance suffered a flash loan attack and lost nearly $200 million in crypto. Several weeks after the event, the thief refunded the stolen money and apologized via encrypted messaging.

Identified only as Jacob by Chainalysis, he started by delivering 54,000 ETH (3,000 on March 18 and 51,000 on March 25) to Euler, followed by 7,000 ETH and $10 million in DAI a few days later.

Although the cyber criminal eventually returned the funds, the exploit prompted the DeFi protocol to add a modular layer named Euler v2 to manage the risks that could render the lending network vulnerable.

Judging from the recent on-chain message sent by the perpetrator to Penpie’s hacker, their apology clearly had  not been genuine.

A recent PeckShield report revealed that crypto platforms faced alarming losses exceeding $313 million due to hacks in August 2024 alone. Over 90% of those attacks, which saw platforms lose over $238 million, originated from phishing.