UwU Lend Protocol Hacked for Nearly $20 Million in Ongoing Cryptocurrency Exploit

Journalist

Hassan Shittu

Journalist

Hassan Shittu

About Author

Hassan, a Cryptonews.com journalist with 6+ years of experience in Web3 journalism, brings deep knowledge across Crypto, Web3 Gaming, NFTs, and Play-to-Earn sectors. His work has appeared in...

Author Profile

Share

Copied

Last updated: 

June 9, 2024

Why Trust Cryptonews

Cryptonews has covered the cryptocurrency industry topics since 2017, aiming to provide informative insights to our readers. Our journalists and analysts have extensive experience in market analysis and blockchain technologies. We strive to maintain high editorial standards, focusing on factual accuracy and balanced reporting across all areas - from cryptocurrencies and blockchain projects to industry events, products, and technological developments. Our ongoing presence in the industry reflects our commitment to delivering relevant information in the evolving world of digital assets. Read more about Cryptonews

In an ongoing security breach, the decentralized finance (DeFi) protocol UwU Lend was hacked on Monday for nearly $20 million. UwU Lend, known for its role as a decentralized finance protocol, allows users to deposit and borrow digital assets, functioning as a liquidity market within the DeFi ecosystem. The exploit, first identified by on-chain security firm Cyvers, has rapidly become a major incident affecting multiple digital assets.

UwU Lend Protocol Hack: Initial Discovery and Immediate Impact

Cyvers initially discovered the exploit, which alerted UwU Lend via a June 10 X post

.

The situation quickly escalated as, within an hour, the amount stolen surpassed $20 million.

🚨ALERT🚨Our system has detected a series of suspicious transactions involving @UwU_Lend!

Attacker has executed 3 transactions and was able to get around $19.5M. But hack is still ongoing! Amount might increase. Right now attacker is swapping stolen digital assets to $ETH.… https://t.co/8cAB2NWwKV pic.twitter.com/V2RrqYagD2

— 🚨 Cyvers Alerts 🚨 (@CyversAlerts) June 10, 2024

UwU Lend is now grappling with the fallout from this major breach. The unknown hacker has successfully drained various assets from the protocol’s pools, converting them into Ethereum (ETH).

Cyvers’ co-founder and chief technology officer, Meir Dolev, elaborated on the situation in a report.

“The attack is still ongoing, but we can already see that we’re talking about a major incident that has already passed the $20 million threshold,” he said. “We’re talking about different assets (like WBTC and DAI) that are drained from the pools and being converted to ETH.”

Further investigations revealed that the attack was facilitated by the well-known crypto-mixing protocol Tornado Cash, which the hacker used to fund the exploit.

“The UwU lending contract was exploited by an attacker that executed three transactions in six minutes and drained approximately $20 million,” Dolev explained. “The attacker was funded from Tornado Cash two days ago.”

The protocol was paused a little under an hour ago while the team investigates the situation. Please rest assured that we were made aware of the situation immediately and are taking all necessary steps, doing our best here. Stay tuned for further updates.

— UwU Lend (@UwU_Lend) June 10, 2024

In response to the attack, the UwU team announced that the protocol was paused less than an hour ago to investigate the situation. The team assured users, stating,

Rising Trend of Crypto Hacks in 2024

According to a recent report by Immunefi, in May 2024, the crypto industry suffered approximately $473.22 million in losses from 108 incidents.

The figure marks a 12% decrease from May 2023, when losses were recorded at over $59 million, and a 28% decrease month-over-month. The majority of the losses in May 2024 stemmed from two significant projects: Gala Games, a crypto gaming project, which suffered a $21 million loss, and Sonne Finance, a decentralized lending protocol, which faced a $20 million loss.

During this period, DeFi platforms were the primary targets for exploits, while CeFi did not experience any major attacks.

Hacks were the predominant cause of financial losses, accounting for $50,618,600 across 14 incidents, while fraud accounted for $1,753,300 from seven events. Ethereum and BNB Chain were the most targeted blockchains, representing 62% of the total losses.

In a related attack last month, decentralized finance (DeFi) lending protocol Pike Finance suffered a major security breach, losing $1.6 million over three days due to a smart contract vulnerability.

On April 30, an attacker exploited Pike’s Ethereum, Arbitrum, and Optimism chain vulnerability, draining $1.68 million. This was the second attack following a $300,000 exploit on April 26, both stemming from the same vulnerability that allowed the attacker to change the output address and override the contract.