The UwU Lend protocol is once again under siege in a continuing cryptocurrency exploit. On June 10, the protocol was initially hacked for nearly $20 million. Now, just three days later, attackers have struck again, stealing an additional $3.5 million from various asset pools.
The targeted pools include uDAI, uWETH, uLUSD, uFRAX, uCRVUSD, and uUSDT. All the stolen assets have been converted to Ether and are traced to the attacker’s address: 0x841dDf093f5188989fA1524e7B893de64B421f47.
UwU Lend Protocol: Repeated Attacks Highlight Vulnerabilities
The onchain data analytics platform Cyvers has confirmed that the same attackers are responsible for both exploits. The first exploit exploited price manipulation, where the attacker used a flash loan to lower the price of Ethena USDe (USDE) and Ethena Staked USDe (SUSDE). By depositing the tokens to UwU Lend, they borrowed more SUSDE than expected and repeated the process with Curve DAO (CRV) tokens, ultimately stealing nearly $20 million.
The ongoing exploit is leveraging the sUSDE tokens obtained in the first attack. Despite the protocol being paused, UwU Lend still considered sUSDE as legitimate collateral. This oversight allowed the attackers to drain the remaining pools, according to crypto security firm CertiK.
Reimbursement Process and Future Steps
Before the second exploit, UwU Lend had initiated the reimbursement process for the victims of the first attack. The protocol announced on X that it had repaid all bad debt for the Wrapped Ether (wETH) market, totaling 481.36 wETH, worth over $1.7 million. In total, $9.7 million has been reimbursed to victims.
UwU Lend protocol claims to have identified and resolved the vulnerability responsible for the initial exploit, stating that all other markets had been thoroughly reviewed by industry professionals and auditors without finding further issues. However, the recent attack indicates that additional measures are needed to secure the protocol and prevent future exploits.
Disclosure Statement: Miami Crypto does not take any external funding, or support to bring crypto news to the readers. We do not have any conflicts of interest while writing news stories on Miami Crypto.