UwU Lend

Wrapped Bitcoin

DeFi

Million

USDe

<a href="https://bitcoinworld.co.in/defi-protocol-uwu-lend-suffers-second-3-7-million-attack-during-reimbursement-process/" title="DeFi Protocol UwU Lend Suffers Second $3.7 Million Attack During Reimbursement Process" rel="nofollow"></a>
DeFi lending protocol UwU Lend has suffered two attacks in the past three days. The second exploit occurred on Thursday during the protocol’s reimbursement process from the first hack. The ongoing saga has taken around $23 million from the protocol. 
<h3 id="span-style-font-weight-400-defi-protocol-hit-with-20-million-exploit-span">DeFi Protocol Hit With $20 Million Exploit</h3> 
On June 10, DeFi project <a href="https://bitcoinworld.co.in/lending-protocol-uwu-lend-hacked-hackers-stole-19-3-million-away/">UwU Lend</a> was hit by a sophisticated attack that took $19.3 million. The attack seemingly involved the use of flash loans to exploit the protocol.&nbsp; 
The project quickly addressed the situation by pausing the protocol and assured users that most assets were safe. 
Additionally, the team offered a $4 million white hat bounty for the return of the funds. The list of stolen assets included Wrapped Ethereum (wETH), Wrapped Bitcoin (wBTC), Curve DAO (CRV), Tether (USDT), Staked USDe (sUSDE), and others. 
Blockchain security firm Beosin <a href="https://x.com/BeosinAlert/status/1800336632371192182">revealed</a> that the attacker manipulated the price of USDe (USDE) by swapping it for other tokens through flash loans. Seemingly, this move lowered USDe and sUSDE’s price. 
<blockquote class="twitter-tweet" data-width="550" data-dnt="true"> 
 Analysis of <a href="https://twitter.com/UwU_Lend?ref_src=twsrc%5Etfw">@UwU_Lend</a> attack: 
 UwU Lend attack is caused by price manipulation. The attacker first use flash loan to swap <a href="https://twitter.com/search?q=%24USDe&amp;src=ctag&amp;ref_src=twsrc%5Etfw">$USDe</a> for other tokens, which led to a lower price of <a href="https://twitter.com/search?q=%24USDe&amp;src=ctag&amp;ref_src=twsrc%5Etfw">$USDe</a> and <a href="https://twitter.com/search?q=%24sUSDe&amp;src=ctag&amp;ref_src=twsrc%5Etfw">$sUSDe</a>. 
 The attacker deposited some to UwU Lend and then lent more <a href="https://twitter.com/search?q=%24sUSDe&amp;src=ctag&amp;ref_src=twsrc%5Etfw">$sUSDe</a> than expected. <a href="https://t.co/wanIwZymBZ">pic.twitter.com/wanIwZymBZ</a> 
 — Beosin Alert (@BeosinAlert) <a href="https://twitter.com/BeosinAlert/status/1800336632371192182?ref_src=twsrc%5Etfw">June 11, 2024</a>
</blockquote> 
<script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
Following the price manipulation, the hacker deposited part of the tokens to UwU Lend and “lent more $sUSDe than expected,” driving USDe’s price higher.&nbsp; 
Similarly, the attacker deposited the sUSDE to the DeFi protocol and borrowed CRV. 
On Wednesday, UwU Lend informed users that its team had identified the vulnerability.&nbsp; Per the post, it was a vulnerability unique to the sUSDE market oracle and had been resolved at the time of the report. 
As a result, the protocol was unpaused, and the markets were slowly relaunched to return to their normal operations.&nbsp; 
The DeFi project also announced it would repay all its bad debt and that users’ funds had not been lost during the exploit, claiming that their funds “are safu at UwU Lend.” 
<h3 id="span-style-font-weight-400-do-you-get-d-f-vu-span">Do You Get DéFì Vu?</h3> 
What seemed to be the end of the story turned out to be the first installment of a saga. On Thursday, reports of a second attack on UwU Lend appeared as the protocol carried out its reimbursement process. 
According to the reports, the same attacker drained another $3.7 million from the DeFi protocol before converting the funds to ETH again. The affected pools included uDAI, uWETH, uLUSD, uFRAX, UCRVUSD, and uUSDT. 
The crypto community expressed their concern about the second attack, with many questioning if their funds were indeed safe. Users started to joke that funds were not “safu” but were “with Sifu” instead. 
UwU Lend was founded by Michael Patryn, also known as Sifu. Patryn was the co-founder of the now-collapsed QuadrigaCX.&nbsp; 
As reported, Canadian authorities were pursuing an unexplained wealth order (UWO) against Sifu for his involvement in the exchange’s criminal activities. 
The DeFi project has paused the protocol for the second time this week, and the situation is being investigated. However, online reports claim that the second exploit was caused by a vulnerability similar to the first attack. 
MetaTrust Labs <a href="https://x.com/MetaTrustLabs/status/1801196924277858677">explained</a> the hacker seemingly used 60 million uSUSDE obtained from Monday’s hack “as collateral to drain the pool.” 
<blockquote class="twitter-tweet" data-width="550" data-dnt="true"> 
 Due to the <a href="https://twitter.com/UwU_Lend?ref_src=twsrc%5Etfw">@UwU_Lend</a> paused the protocol, we'd like to expose the reason of the today's hack. 
 The hacker used 60M <a href="https://twitter.com/search?q=%24uSUSDE&amp;src=ctag&amp;ref_src=twsrc%5Etfw">$uSUSDE</a> he/she got in the previous hack as collateral to drain the pool, and now still has 5M <a href="https://twitter.com/search?q=%24uSUSDE&amp;src=ctag&amp;ref_src=twsrc%5Etfw">$uSUSDE</a>. 
 For UWU Lend, it is recommended to stop supporting the <a href="https://twitter.com/search?q=%24SUSDE&amp;src=ctag&amp;ref_src=twsrc%5Etfw">$SUSDE</a>… <a href="https://t.co/KWWFu6bYmk">https://t.co/KWWFu6bYmk</a> <a href="https://t.co/UecVF5p9Qi">pic.twitter.com/UecVF5p9Qi</a> 
 — MetaTrust Labs (@MetaTrustLabs) <a href="https://twitter.com/MetaTrustLabs/status/1801196924277858677?ref_src=twsrc%5Etfw">June 13, 2024</a>
</blockquote> 
<script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
The news caused users to wonder whether the UwU Lend team was unaware of the tokens in the attacker’s wallet. Some also questioned why they didn’t stop supporting the sUSDE collateral. 
At the time of writing, an official explanation for the second exploit has not been published. 
<blockquote>
 Disclaimer: The information provided is not trading advice. Bitcoinworld.co.in holds no liability for any investments made based on the information provided on this page. We strongly recommend independent research and/or consultation with a qualified professional before making any investment decisions.
</blockquote>

DeFi Protocol UwU Lend Suffers Second $3.7 Million Attack During Reimbursement Process

Table of Contents

ItsBitcoinWorld

Other articles published on Jun 14, 2024

BOME Price Prediction:Is Bome Poised to Lead the Meme Rally?

5 Best Penny Cryptocurrency To Buy – Which Crypto Coins Could Hit 1 Dollar?

Cardano Founder Speculates: Does Elon Musk Possess 20% of Dogecoin’s Total Supply?

AI News: New OpenAI Appointment Sparks Fresh Privacy Concerns

Join the EURO24Meme Presale: Your Opportunity for Potential 100X Returns

Nigeria Drops Charges Against Binance Executives

Join our free newsletter for daily crypto updates!