A recent hack targeted the Ethereum-based lending protocol Uwulend, resulting in a $20 million loss.
The attack, which involved three transactions converting Wrapped Bitcoin and DAI into Ether, was detected early Monday morning by Cyvers Alerts.
Funds aren’t safu
The suspicious activity was quickly identified by Cyvers Alerts, which noted the conversion of WBTC and DAI into ETH.
The Uwulend team immediatelly informed users via X, announcing that the platform had been paused to investigate the breach, and they shared the wallet associated with the exploiter currently holds 1,282 ETH, equivalent to $4.7 million.
Despite the scale of the exploit, the UWU token didn’t see a drastic price drop, the token’s value fell by 3% to $2.91, continuing its year-long decline.
Over the past year, UWU has lost 80% of its value, with a market capitalization now standing at $26 million, according to CoinGecko data.
Oracle manipulation
Cyvers Alerts reported that the attacker funded the exploit using assets withdrawn from the cryptocurrency mixer Tornado Cash two days prior.
The hack was facilitated by a vulnerability in a price oracle that affected five different tokens, and the value of the sUSDe asset, determined by a median from multiple sources, was manipulated during the attack.
These sources included FRAXUSDe, USDeUSDC, USDeDAI, USDecrvUSD, and GHOUSDe.
Code is law, but coding error isn’t
Decentralized finance (DeFi) protocols like Uwulend are particularly vulnerable to exploits due to potential bugs, coding errors, poorly written smart contracts, and vulnerabilities in associated assets or third-party services like oracles.
Uwulend operates as a decentralized, non-custodial liquidity market protocol and claims to have generated over $9.3 million in fees.
According to DefiLlama, the platform has $66 million in total value locked, a big drop from its peak of $115 million in late April.
The protocol was founded by Sifu, a famous and controversial figure and co-founder of the defunct crypto exchange QuadrigaX, which collapsed in 2019 after losing $190 million in customer funds.
