Track market-moving stories before they get noisy

The UwU Lend hacker returns to swipe another $3.7 million.The lending protocol was hacked using a flash loan for $23 million on Monday.UwU Lend users rejoiced on Wednesday after the lending protocol said it was able to fully reimburse victims of its recent $23 million exploit.

But their celebrations were cut short when at 7:46 am London time, the same hacker returned to take another $3.7 million.

That’s despite UwU Lend offering the hacker a 20% bounty — worth $4 million — to return users’ funds from a Monday hack.

According to Yaron Velner, CEO of risk management project B.Protocol, the hacker was able to drain more money from the protocol using its intended functions due to an oversight from its developers.

“The operation today did not entail any manipulation. Just a malicious intent, and erroneous configuration on UwU side,” he told DL News.

It comes after UwU Lend said in a June 12 X post that it had identified and fixed the vulnerability in its sUSDe market that the hacker previously exploited.

“All other markets have been re-reviewed by industry professionals and auditors with no issues or concerns found,” the protocol said.

UwU Lend did not return a request for comment.

UwU Lend began repaying users on Wednesday after the $23 million exploit forced it temporarily offline.

As of 5 am on Thursday, the protocol said it had repaid about $9.7 million stolen in the first hack.

“The protocol will repay all bad debt, as quickly as reasonably possible,” UwU Lend said. “We are happy to announce that no user funds have been lost due to this process.”

UwU Lend’s controversial founder Michael Patryn, better known by his pseudonym 0xSifu, had previously offered to drop any charges if the hacker returned 80% of the stolen crypto, worth about $18 million.

Oracle attackOn Monday, a hacker used a $4 billion flash loan to manipulate the price of certain tokens on UwU Lend, which allowed them to drain the protocol.

A flash loan is a type of DeFi transaction where a user borrows funds from a lending protocol and repays them in the same transaction.

While flash loans are often used by market makers to quickly arbitrage price differences in DeFi markets, they also make possible exploits that require large amounts of capital to perform.

Zircuit co-founder Martin Derka — who co-developed a tool to detect flash loan-based exploits while at crypto security firm Quantstamp — said such exploits were notorious in DeFi.

“These kinds of vulnerabilities are usually very difficult to discover during smart contract audits, because they require in-depth knowledge of multiple protocols — those that one is auditing, and those that are being used as oracles,” he told DL News.

“There are also not enough automated tools that are capable of discovering such vulnerabilities.”

Launched in 2022, UwU Lend is a fork of Aave, the largest DeFi lending protocol with $12.4 billion of deposits.

A fork is where a developer team uses the open-source code from an existing DeFi protocol to launch a similar protocol — often on a different blockchain or with minor changes.

But the changes to Aave’s code allowed the hacker to drain UwU Lend. The protocol used easily manipulated oracles — software that provides it with the prices of various tokens.

UwU Lend’s UWU token is down 15% over the past week, and trades at around $2.70.

Update, June 13: This article was updated to include comments from B.Protocol CEO Yaron Velner that clarify the $3.7 million theft was not caused by a separate exploit. An earlier version misstated the name of the blockchain Martin Derka co-founded; it is Zircuit, not Circuit.

Aleks Gilbert is a DeFi Correspondent at DL News. Got a tip? Email him at [email protected].

Related Topics

UwU Lend suffers a second exploit this week, resulting in a $3.7 million loss. The same exploiter is believed to be responsible.

The UwU Lend protocol, previously targeted in a nearly $20 million hack on June 10, is facing an ongoing cryptocurrency exploit that has so far resulted in the theft of $3.7 million.

This development comes as the protocol has been making efforts to reimburse its users following the $19.3 million June 10 hack.

$3.7 Million Hack Cyvers, an on-chain data analytics platform, was the first to alert UwU Lend about the ongoing exploit. According to its findings, the bad actors behind this latest incident appear to be the same as those responsible for the earlier $19.3 million heist.

ALERT@UwU_Lend has suffered another security breach by the same attacker!

Total loss: $3.7M
Affected pools: uDAI, uWETH, uLUSD, uFRAX, uCRVUSD, uUSDT
All stolen assets have been converted to $ETH and are located at the attacker’s address: https://t.co/9TvwLh18P1

To learn… https://t.co/AjcMS1Cdyl

— Cyvers Alerts (@CyversAlerts) June 13, 2024

The stolen funds, sourced from various asset pools, including uDAI, uWETH, uLUSD, uFRAX, uCRVUSD, and uUSDT, have already been converted into Ethereum and transferred to the attacker’s address.

Following the initial breach on June 10, the development team at UwU Lend notified the community that they had implemented immediate measures to mitigate the damage. The protocol was temporarily paused while investigations were conducted into the vulnerabilities exploited by the hackers.

In an update shared on June 12 via a thread on X, the UwU developer team disclosed that they had identified the specific vulnerability related to the sUSDe market oracle and claimed to have resolved it.

You may also like: Important Ripple (XRP) Deadline Concerning Many Users Jaredfromsubway Hacker Ignores 50% Bounty, Routes Funds to Tornado Cash Sahara AI Denies Security Issues as Token Price Drops Over 60% (1/5)

The team has now identified the vulnerability, which was unique to the sUSDe market oracle and has now been . All other markets have been re-reviewed by industry professionals and auditors with no issues or concerns found.

— UwU Lend (@UwU_Lend) June 12, 2024

They added that independent audits of all other markets had been conducted without discovering additional issues, assuring users that all functions would resume promptly and emphasized that no user funds had been permanently lost during the incident.

Reimbursement Efforts Following the incident, UwU initiated reimbursement efforts, informing users that “The protocol will repay all bad debt as quickly as reasonably possible. We will keep users up to date about progress and the next steps.”

In a final update on June 13, the team reported that they had successfully reimbursed a total of $9,715,288 to affected users thus far. The breakdown included specific amounts returned in various cryptocurrencies such as DAI, crvUSD, USDT, and wETH.

Repaid so far:
• 3,522,427 $DAI
• 233,819 $crvUSD
• 4,225,000 $USDT
• 481.36 $wETH ($1,734,042)
Total: $9,715,288

! #FundsAreUwU

— UwU Lend (@UwU_Lend) June 13, 2024

UwU Lend, a fork of the open-source AAVE v2 protocol, offers its users various decentralized finance services such as lending, borrowing, and staking. One of its unique features includes a revenue-sharing token called UwU, which allows users to earn a portion of the platform’s revenues directly.

Tags: