UwU Lend (2024) — Crypto Hack
LaunderedUwU Lend was exploited for ~$19.4M through a sophisticated flash loan attack that manipulated the protocol's price oracle to extract value from its lending markets.
Summary
UwU Lend was exploited for ~$19.4M through a sophisticated flash loan attack that manipulated the protocol's price oracle to extract value from its lending markets.
How It Was Compromised — DeFi via Smart Contract Exploit / Flash Loan / Price Oracle Manipulation
On June 10, 2024, UwU Lend, an Ethereum-based lending protocol, was exploited for approximately $19.4M. The attacker used a flash loan to manipulate the price of the sUSDe token, which was used as collateral in the protocol's lending markets. By inflating the sUSDe price, the attacker was able to borrow significantly more than their collateral should have permitted. The exploit was executed across multiple transactions and drained several of the protocol's lending pools. UwU Lend paused the protocol and engaged with blockchain analytics firms to track the stolen funds.
Fund Flow & Laundering Analysis
Stolen tokens were swapped to ETH and stablecoins via decentralized exchanges. The ETH was then moved through multiple intermediary wallets before being deposited into Tornado Cash. The attacker used a complex network of intermediary wallets to fragment the laundering trail. UwU Lend offered a bounty for the return of the funds.