UwU Lend 在 Oracle 操縱攻擊中損失 1,940 萬美元

Cyvers 首先發現了該漏洞，揭露了在六分鐘內執行的三筆交易的複雜序列。

The former chief financial officer of Frog Nation, Sifu, lost $19.4 million in an oracle manipulation attack on his lending protocol, Uwu Lend.

Frog Nation 前財務長 Sifu 在對其借貸協議 Uwu Lend 發起的預言機操縱攻擊中損失了 1,940 萬美元。

Cyvers, who discovered the vulnerability first, disclosed a complex sequence of three transactions carried out in under six minutes. The thieves used Tornado Cash to buy Wrapped Bitcoin (WBTC) and Dai (DAI), which they then turned into Ether (ETH).

最先發現該漏洞的 Cyvers 揭露了在六分鐘內執行的三筆交易的複雜序列。竊賊使用 Tornado Cash 購買了 Wrapped Bitcoin (WBTC) 和 Dai (DAI)，然後將其轉換為 Ether (ETH)。

The decentralized finance (DeFi) system UwU Lend was the victim of a continuing crypto attack that gained approximately $20 million on Monday, June 10. It was the on-chain security company Cyvers who discovered the problem and posted on social media platform X to notify the community:

去中心化金融（DeFi）系統UwU Lend 是持續加密攻擊的受害者，6 月10 日星期一，該攻擊造成約2000 萬美元的損失。 X 上發布了通知社群：

“Hey @UwU_Lend, someone is trying to get you! At this point, the address has received almost fourteen million dollars…”

「嘿@UwU_Lend，有人想抓你！至此，該地址已收到近一千四百萬美元…”

Cyvers claims that a complex sequence of transactions led to an assault on UwU Lend, a liquidity market where users may deposit and borrow digital assets. Within an hour after the first alarm, the hack had grown to include almost $20 million in stolen cash.

Cyvers 聲稱，一系列複雜的交易導致了對 UwU Lend 的攻擊，UwU Lend 是一個流動性市場，用戶可以在其中存入和借入數位資產。在第一次警報發出後一個小時內，駭客攻擊已經擴大到被盜現金近 2000 萬美元。

Tornado Cash, a crypto-mixing technology, provided the funding for the lightning-fast and pinpoint assault. The hacker depleted around $20 million in only six minutes via three fraudulent transactions. Tornado Cash provided the attack’s funds, as Cyvers revealed two days prior to the exploit.

Tornado Cash 是一種加密貨幣混合技術，為閃電般快速且精準的攻擊提供了資金。駭客在短短 6 分鐘內透過三筆詐騙交易消耗了約 2000 萬美元。正如 Cyvers 在攻擊發生前兩天透露的那樣，Tornado Cash 提供了這次攻擊的資金。

Peckshield claims that the sUSDe asset, which was valued using a median from many sources, has a pricing oracle flaw at its core. During the hack, the perpetrator modified five sources, leading to the vulnerability.

Peckshield 聲稱，sUSDe 資產採用多種來源的中位數進行估值，其核心存在定價預言機缺陷。在駭客攻擊期間，犯罪者修改了五個來源，導致了漏洞。

El Salvador issued a draft for Bitcoin banking legislation

薩爾瓦多發布比特幣銀行立法草案

Ripple and Colombia’s Central Bank Investigate the XRP…

Ripple 和哥倫比亞中央銀行調查 XRP…

Quickly halting its procedure and setting borrowing and deposit rates to 0% to safeguard user holdings, UwU Lend responded to the assault by pausing it. On their X page, the squad explained what they were doing right now and what they were looking into right now:

UwU Lend 迅速停止了其程序，並將借貸和存款利率設置為 0%，以保護用戶持有的資產，UwU Lend 透過暫停來回應這一攻擊。在他們的 X 頁面上，團隊解釋了他們現在正在做什麼以及正在研究什麼：

“We are now waiting for the hacker to respond to the offer we made. There will be no more changes to the procedure until the study is complete.”

「我們現在正在等待駭客對我們提出的提議做出回應。在研究完成之前，程序不會再有任何改變。

In a bid to dismiss any charges, UwU Lend creator Michael Patryn—also known as 0xSifu—offered the hacker around $16 million in cryptocurrency. Through an on-chain message, he declared:

為了駁回任何指控，UwU Lend 創始人 Michael Patryn（又名 0xSifu）向駭客提供了約 1,600 萬美元的加密貨幣。他透過鏈上訊息宣布：

“A 20% white hat reward on any funds stolen is on the table. We will not pursue this further, and you will not have any problems with police enforcement.”

「對任何被盜資金的 20% 的白帽獎勵已經擺在桌面上。我們不會再追究此事，警方執法也不會有任何問題。

Anyone who could identify the exploiter and assist in their apprehension would be eligible for the reward after the deadline had passed. The scenario became much more complicated when another person offered the hacker instructions on how to shift the cash undetected via an on-chain communication.

任何能夠識別剝削者並協助逮捕他們的人都將有資格在截止日期過後獲得獎勵。當另一個人向駭客提供如何透過鏈上通訊在不被發現的情況下轉移現金的指示時，情況變得更加複雜。

Two addresses presently hold the stolen funds, which include substantial sums of WETH, WBTC, bLUSD, crvUSD, sDAI, CRV, DAI, USDT, and sUSDe. Roughly $23 million is the sum amount of the projected losses.

目前有兩個地址持有被盜資金，其中包括大量 WETH、WBTC、bLUSD、crvUSD、sDAI、CRV、DAI、USDT 和 sUSDe。預計損失總額約 2,300 萬美元。

Also Read: Swan Bitcoin and Tucker Carlson Form a Partnership

另請閱讀：Swan Bitcoin 和 Tucker Carlson 建立合作夥伴關係