Euler: lending platforms rating breakdown
V2, 16 chains
The most useful case study in DeFi, and the highest-earning market we measured: 6.37% gross per dollar deposited, ten times JustLend. In March 2023 a flash-loan attack took $197m out of Euler — and over the following three weeks the team negotiated the attacker into returning all of it, roughly $240m of assets, with an on-chain apology attached. It is the only nine-figure DeFi exploit where depositors were made whole in full.
The most useful case study in DeFi, and the highest-earning market we measured: 6.37% gross per dollar deposited, ten times JustLend. In March 2023 a flash-loan attack took $197m out of Euler — and over the following three weeks the team negotiated the attacker into returning all of it, roughly $240m of assets, with an on-chain apology attached.
How the score is built
Each criterion is scored 0–10 and weighted. The median column is the middle score across every entry in this ranking, so a row reads as a position rather than a number.
| Criterion | What we measured | Weight | Score | Category median | Rank | Weighted gap |
|---|---|---|---|---|---|---|
| Incidents, bad debt, and who ate it | 100% funds returned after the 2023 exploit · sourced · 2026-08-27 · source | 32% | 6 | 6.5 | 6 of 10 | -0.16 |
| What the market actually earns | 6.37 gross yield per dollar deposited · computed · 2026-08-27 · source | 22% | 10 | 7.5 | 1 of 10 | +0.55 |
| Scale and the ability to exit | $366m total value locked · sourced · 2026-08-27 · source | 22% | 4 | 7 | 10 of 10 | -0.66 |
| Risk architecture | — | 14% | 8 | 7 | 1 of 10 | +0.14 |
| Chains and assets | 16 chains with deposits · sourced · 2026-08-27 · source | 10% | 8 | 6 | 3 of 10 | +0.20 |
Measured 27 August 2026 · weights and method · decided by scale and the ability to exit, worth -0.66 points against the median
Incidents, bad debt, and who ate it: 6/10
Every exploit and every bad-debt event with dates and amounts, and then the question that decides whether it matters: were depositors made whole, and by whom. Euler lost $197m in March 2023 and returned 100% of it after negotiating with the attacker. Venus carried nine figures of bad debt from a single oracle manipulation in 2021. Those are opposite outcomes from superficially similar headlines, and a rating that treats "has been hacked" as one fact is useless.
Scored 6 of 10 against a category median of 6.5, which places it 6th of 10 among lending platforms on this criterion. At a 32% weight that is 0.16 points below the median contribution of the weighted total. The best score in the category is 9, the worst 3.
What the market actually earns: 10/10
Computed by us: thirty days of protocol fees, annualised, divided by total value locked. That is the gross interest the market genuinely generated per dollar deposited — before the protocol’s cut and before incentives. It is the honest version of the APY a front end shows you, and it separates a market where borrowers are really paying from one where the TVL headline is parked capital earning close to nothing.
Scored 10 of 10 against a category median of 7.5, which places it 1st of 10 among lending platforms on this criterion. At a 22% weight that is 0.55 points above the median contribution of the weighted total. The best score in the category is 10, the worst 1.
Scale and the ability to exit: 4/10
Total value locked at a stated timestamp, and whether the market is deep enough that a withdrawal at size does not itself move the utilisation rate. In lending, depth is not a convenience — a market that is 99% utilised cannot pay you out until somebody repays.
Scored 4 of 10 against a category median of 7, which places it 10th of 10 among lending platforms on this criterion. At a 22% weight that is 0.66 points below the median contribution of the weighted total. The best score in the category is 10, the worst 4.
Risk architecture: 8/10
Sourced to documentation: are markets isolated or pooled, what oracle secures each collateral, who can change a listing or a loan-to-value ratio and how fast, and — for the newer curated-vault designs — who exactly is picking your risk and whether they carry any of it. A single shared pool means one bad listing can impair everyone.
Scored 8 of 10 against a category median of 7, which places it 1st of 10 among lending platforms on this criterion. At a 14% weight that is 0.14 points above the median contribution of the weighted total. The best score in the category is 8, the worst 3.
Chains and assets: 8/10
Deployments with real deposits, not deployment count. A protocol on forty chains with liquidity on three is scored on the three.
Scored 8 of 10 against a category median of 6, which places it 3rd of 10 among lending platforms on this criterion. At a 10% weight that is 0.20 points above the median contribution of the weighted total. The best score in the category is 10, the worst 1.
Its nearest neighbours in this ranking
Incidents priced into this score
- 2023-03-13 — A flash-loan attack exploiting a missing health check in the donation flow drained roughly $197m. Between 18 March and 4 April 2023 the attacker returned all recoverable funds — about $240m of assets — after negotiation, apologising on-chain. Depositors were made whole in full. [users made whole: confirmed] [source]
Questions about this score
Did Euler users get their money back after the 2023 hack?
+
All of it. Roughly $197m was drained on 13 March 2023, and between 18 March and 4 April the attacker returned all recoverable funds — about $240m of assets — after negotiation, apologising on-chain in the process. It is the only exploit of that scale in DeFi history with a complete recovery, and the reason it happened was that one individual chose to give the money back. That is an outcome, not a security property, and nobody should price the next incident on it.
Why does Euler pay so much more than Aave?
+
Because it is small and borrower demand is concentrated. Our measurement puts Euler at 6.37% gross yield per dollar deposited against Aave's 2.03% — but Euler holds $366m against Aave's $18.39bn, and thin markets pay more precisely because exit at size is not guaranteed. The rate is compensation for that, not a free improvement.
Is Euler V2 the same protocol that was hacked?
+
It is the same team and a rebuilt architecture. V2 was designed after the incident with a much more conservative structure, and the specific flaw — a missing health check in the donation flow — belongs to code that no longer runs. What carries over is the record of how the team behaved when it went wrong, which we score as the strongest incident response in this category.