UwU Lend (second exploit) hack — June 2024

UwU Lend, an Ethereum lending protocol, was drained a second time on 13 June 2024, three days after a larger attack on 10 June. Cyvers Alerts flagged the transactions as they occurred; SlowMist, CertiK, Beosin and BlockSec published analyses.

Analysts disagree on whether the second attack repeated the first. On 10 June the attacker used flash loans to distort the sUSDe and USDe price feeds and took roughly $19.3 million to $20 million. UwU Lend then said it had identified and resolved the flaw, which it described as unique to the sUSDe market oracle, unpaused the protocol and began repaying bad debt. According to CertiK, the protocol continued to treat the uUSDE collateral the attacker had minted during the first incident as legitimate: the attacker 'had gained a significant number of uUSDE tokens from the first exploit and was still holding them,' which 'allowed the threat actors to exploit the remaining uUSDE amounts and drain all other UwULend pools.' Unchained reports the attacker used 60 million sUSDe from the previous hack as collateral. The uDAI, uWETH, uLUSD, uFRAX, uCRVUSD and uUSDT pools were drained and the proceeds converted to ether. The Block, citing Beosin and BlockSec, instead described the second incident as a flash loan exploit consistent with the first, attributed to the same perpetrator.

The size is reported inconsistently. Cyvers, The Block and Unchained give about $3.7 million; SlowMist's figure, cited by The Defiant, is $3.72 million; Crypto Briefing, working from CertiK's account, gives $3.5 million. Combined losses across the two June incidents are generally stated as about $23 million.

UwU Lend's founder Michael Patryn, known onchain as 0xSifu, offered the attacker a 20% bounty in exchange for returning 80% of the stolen funds, then a $5 million bounty to the first person to identify and locate them. Neither produced a return. The protocol repaid depositors from its own funds, disclosing $9.7 million of bad debt repaid as of the second attack; no source establishes that reimbursement was completed.