Blockchain security firm Cyvers Alert reported a major exploit on the DeFi lending protocol UwU Lend, resulting in a loss of approximately $19.5 million.

The attacker funded their wallet using the sanctioned crypto mixer Tornado Cash.

In a June 10 statement to CryptoSlate, Cyvers co-founder and CTO Meir Dolev said:

“The UWU lending contract was exploited by an attacker who executed three transactions in six minutes, draining approximately $20 million.”

On-chain data shows the attacker’s wallet moved several digital assets, including wrapped Ethereum (WETH), wrapped Bitcoin (WBTC), and stablecoins like USDC. The attacker’s address has been tagged as the UwU Lend Exploiter on Etherscan.

Web3 security firm PeckShield confirmed the incident, identifying a price oracle issue as the root cause. It explained:

“The sUSDe asset is priced as a median from multiple sources. Five of these sources—FRAXUSDe, USDeUSDC, USDeDAI, USDecrvUSD, and GHOUSDe—were manipulated during the hack.”

UwU Lend confirmed the incident and immediately paused its platform, stating:

“[We are] taking all necessary steps [and] doing our best here. Stay tuned for further updates.”

Despite the exploit, the total value of assets locked on UwU Lend surged by 135% in the last 24 hours.

Data from DeFiLlama indicates that UwU Lend currently holds over 82,000 ETH, valued at $305 million, though approximately $247 million of these funds are borrowed.

UwU Lend was developed by Michael Patryn—also known as Sifu or 0xSifu—the controversial founder of the defunct Quadriga CX exchange. The platform allows depositors to provide liquidity to earn passive income, while borrowers can obtain liquidity in an over-collateralized manner. Liquidity providers can also earn revenue by staking their LP tokens.