UwU Lend 在償還過程中遭受第二次 370 萬美元的攻擊

過去三天，DeFi 借貸協議 UwU Lend 遭受了兩次攻擊。第二次攻擊發生在周四，在第一次駭客攻擊的協議補償過程中。

DeFi lending protocolUwU Lend has been hit by two attacks in the past three days, with the second exploit occurring on Thursday during the protocol’s reimbursement process from the first hack. The ongoing saga has taken around $23 million from the protocol.

DeFi 借貸協議 UwU Lend 在過去三天內遭受了兩次攻擊，第二次攻擊發生在周四協議第一次黑客攻擊的償還過程中。正在進行的傳奇故事已從該協議中損失了約 2300 萬美元。

DeFi Protocol Hit With $20 Million Exploit

DeFi 協定遭受 2000 萬美元的攻擊

On June 10, DeFi project UwU Lend was hit by a sophisticated attack that took $19.3 million. The attack seemingly involved the use of flash loans to exploit the protocol. The project quickly addressed the situation by pausing the protocol and assured users that most assets were safe.

6 月 10 日，DeFi 專案 UwU Lend 遭受複雜攻擊，損失 1,930 萬美元。這次攻擊似乎涉及使用閃電貸來利用協議。該專案透過暫停協議迅速解決了這個問題，並向用戶保證大多數資產是安全的。

Additionally, the team offered a $4 million white hat bounty for the return of the funds. The list of stolen assets included Wrapped Ethereum (wETH), Wrapped Bitcoin (wBTC), Curve DAO (CRV), Tether (USDT), Staked USDe (sUSDE), and others.

此外，該團隊還提供 400 萬美元的白帽賞金來返還資金。被盜資產包括 Wrapped Ethereum (wETH)、Wrapped Bitcoin (wBTC)、Curve DAO (CRV)、Tether (USDT)、Staked USDe (sUSDE) 等。

Blockchain security firm Beosin revealed that the attacker manipulated the price of USDe (USDE) by swapping it for other tokens through flash loans. Seemingly, this move lowered USDe and sUSDE’s price.

區塊鏈安全公司 Beosin 透露，攻擊者透過閃電貸將 USDe (USDE) 兌換成其他代幣，從而操縱了 USDe (USDE) 的價格。看來，此舉降低了 USDe 和 sUSDE 的價格。

Following the price manipulation, the hacker deposited part of the tokens to UwU Lend and “lent more $sUSDe than expected,” driving USDe’s price higher. Similarly, the attacker deposited the sUSDE to the DeFi protocol and borrowed CRV.

在價格操縱之後，駭客將部分代幣存入 UwU Lend 並“借出了比預期更多的 $sUSDe”，從而推高了 USDe 的價格。同樣，攻擊者將 sUSDE 存入 DeFi 協定並借用 CRV。

On Wednesday, UwU Lend informed users that its team had identified the vulnerability. Per the post, it was a vulnerability unique to the sUSDE market oracle and had been resolved at the time of the report.

週三，UwU Lend 通知用戶，其團隊已經發現了該漏洞。根據該帖子，這是 sUSDE 市場預言機特有的漏洞，在報告發佈時已解決。

As a result, the protocol was unpaused, and the markets were slowly relaunched to return to their normal operations. The DeFi project also announced it would repay all its bad debt and that users’ funds had not been lost during the exploit, claiming that their funds “are safu at UwU Lend.”

結果，該協議沒有暫停，市場也慢慢重新啟動，恢復正常運作。該 DeFi 項目還宣布將償還所有壞賬，並且用戶的資金在利用過程中並未丟失，並聲稱他們的資金「在 UwU Lend 是安全的」。

Do You Get DéFì Vu?

你有 DéFì Vu 嗎？

What seemed to be the end of the story turned out to be the first installment of a saga. On Thursday, reports of a second attack on UwU Lend appeared as the protocol carried out its reimbursement process.

看似故事的結局，結果卻是傳奇的第一部分。週四，在該協議執行報銷流程時，出現了有關 UwU Lend 遭受第二次攻擊的報告。

According to the reports, the same attacker drained another $3.7 million from the DeFi protocol before converting the funds to ETH again. The affected pools included uDAI, uWETH, uLUSD, uFRAX, UCRVUSD, and uUSDT.

據報道，同一攻擊者從 DeFi 協議中又竊取了 370 萬美元，然後再次將資金轉換為 ETH。受影響的礦池包括 uDAI、uWETH、uLUSD、uFRAX、UCRVUSD 和 uUSDT。

The crypto community expressed their concern about the second attack, with many questioning if their funds were indeed safe. Users started to joke that funds were not “safu” but were “with Sifu” instead.

加密社群對第二次攻擊表示擔憂，許多人質疑他們的資金是否確實安全。使用者開始開玩笑說資金不是「safu」而是「with Sifu」。

UwU Lend was founded by Michael Patryn, also known as Sifu. Patryn was the co-founder of the now-collapsed QuadrigaCX. As reported by Bitcoinist, Canadian authorities were pursuing an unexplained wealth order (UWO) against Sifu for his involvement in the exchange’s criminal activities.

UwU Lend 由 Michael Patryn（也稱為 Sifu）創立。 Patryn 是現已倒閉的 QuadrigaCX 的共同創辦人。據 Bitcoinist 報道，加拿大當局正在對 Sifu 實施不明財富令（UWO），因為他參與了交易所的犯罪活動。

The DeFi project has paused the protocol for the second time this week, and the situation is being investigated. However, online reports claim that the second exploit was caused by a vulnerability similar to the first attack.

本週，該 DeFi 計畫已第二次暫停協議，目前情況正在調查中。然而，線上報告聲稱第二次攻擊是由與第一次攻擊類似的漏洞引起的。

MetaTrust Labs explained the hacker seemingly used 60 million uSUSDE obtained from Monday’s hack “as collateral to drain the pool.”

MetaTrust Labs 解釋說，駭客似乎使用了從週一的駭客攻擊中獲得的 6000 萬美元「作為抵押品來耗盡資金池」。

The news caused users to wonder whether the UwU Lend team was unaware of the tokens in the attacker’s wallet. Some also questioned why they didn’t stop supporting the sUSDE collateral.

這項消息讓用戶懷疑 UwU Lend 團隊是否不知道攻擊者錢包中的代幣。有些人也質疑為什麼他們不停止支持 sUSDE 抵押品。

At the time of writing, an official explanation for the second exploit has not been published.

截至撰寫本文時，尚未發布第二個漏洞的官方解釋。