Blockchain security firm Cyvers Alert reported a major exploit on the DeFi lending protocol UwU Lend, resulting in a loss of around $19.5 million.

The attacker funded their wallet using the sanctioned crypto mixer Tornado Cash.

Cyvers co-founder and CTO Meir Dolev stated to CryptoSlate on June 10:

"The UwU lending contract was exploited by an attacker who executed three transactions in six minutes, draining approximately $20 million."

On-chain data shows the attacker’s wallet moved various digital assets, including wrapped Ethereum (WETH), wrapped Bitcoin (WBTC), and stablecoins like USDC. The attacker’s address has been labeled as the UwU Lend Exploiter on Etherscan.

Web3 security firm PeckShield confirmed the incident, noting that a price oracle issue was the root cause. They explained:

"Specifically, the sUSDe asset is priced as a median from multiple sources. Five of them—FRAXUSDe, USDeUSDC, USDeDAI, USDecrvUSD, and GHOUSDe—were manipulated during the hack."

UwU Lend acknowledged the incident and immediately paused its platform, stating:

"[We are] taking all necessary steps [and] doing our best here. Stay tuned for further updates."

Despite the exploit, the total value of assets locked on UwU Lend surged by 135% in the last 24 hours.

According to DeFiLlama, UwU Lend currently holds over 82,000 ETH, valued at $305 million, although approximately $247 million of these funds are borrowed.

UwU Lend was developed by Michael Patryn, also known as Sifu or 0xSifu, the controversial founder of the defunct Quadriga CX exchange. The platform allows depositors to provide liquidity for passive income, while borrowers can obtain liquidity in an over-collateralized manner. Additionally, liquidity providers earn revenue by staking their LP tokens.