UwU Lend DeFi Protocol Exploited for Over $20M in $19.3M Price Oracle Attack

Jun 10, 2024, 02:49 PM

UwU Lend, a decentralized finance (DeFi) protocol, has been exploited in an ongoing attack resulting in losses exceeding $20 million. The attack, identified by multiple blockchain security firms including Cyvers and Arkham, involved three transactions within six minutes, where the attacker converted stolen Wrapped Bitcoin (WBTC) and DAI into Ethereum (ETH). The exploit was facilitated by price oracle manipulation, particularly affecting the sUSDe asset. The attacker was initially funded by Tornado Cash and has been actively moving the stolen funds. UwU Lend, founded by Michael Patryn, also known as 0xSifu, is a fork of Aave and supports various lending activities. The protocol has been paused as the team investigates the breach. Approximately $19.3 million was siphoned before some stolen funds were deposited into Curve’s Llama Lend and subsequently liquidated.