UwU Lend 在偿还过程中遭受第二次 370 万美元的攻击

过去三天，DeFi 借贷协议 UwU Lend 遭受了两次攻击。第二次攻击发生在周四，在第一次黑客攻击的协议补偿过程中。

DeFi lending protocolUwU Lend has been hit by two attacks in the past three days, with the second exploit occurring on Thursday during the protocol’s reimbursement process from the first hack. The ongoing saga has taken around $23 million from the protocol.

DeFi 借贷协议 UwU Lend 在过去三天内遭受了两次攻击，第二次攻击发生在周四该协议第一次黑客攻击的偿还过程中。正在进行的传奇故事已从该协议中损失了约 2300 万美元。

DeFi Protocol Hit With $20 Million Exploit

DeFi 协议遭受 2000 万美元的攻击

On June 10, DeFi project UwU Lend was hit by a sophisticated attack that took $19.3 million. The attack seemingly involved the use of flash loans to exploit the protocol. The project quickly addressed the situation by pausing the protocol and assured users that most assets were safe.

6 月 10 日，DeFi 项目 UwU Lend 遭受复杂攻击，损失 1930 万美元。这次攻击似乎涉及使用闪电贷来利用该协议。该项目通过暂停协议迅速解决了这一问题，并向用户保证大多数资产是安全的。

Additionally, the team offered a $4 million white hat bounty for the return of the funds. The list of stolen assets included Wrapped Ethereum (wETH), Wrapped Bitcoin (wBTC), Curve DAO (CRV), Tether (USDT), Staked USDe (sUSDE), and others.

此外，该团队还提供 400 万美元的白帽赏金来返还资金。被盗资产包括 Wrapped Ethereum (wETH)、Wrapped Bitcoin (wBTC)、Curve DAO (CRV)、Tether (USDT)、Staked USDe (sUSDE) 等。

Blockchain security firm Beosin revealed that the attacker manipulated the price of USDe (USDE) by swapping it for other tokens through flash loans. Seemingly, this move lowered USDe and sUSDE’s price.

区块链安全公司 Beosin 透露，攻击者通过闪电贷将 USDe (USDE) 兑换成其他代币，从而操纵了 USDe (USDE) 的价格。看来，此举降低了 USDe 和 sUSDE 的价格。

Following the price manipulation, the hacker deposited part of the tokens to UwU Lend and “lent more $sUSDe than expected,” driving USDe’s price higher. Similarly, the attacker deposited the sUSDE to the DeFi protocol and borrowed CRV.

在价格操纵之后，黑客将部分代币存入 UwU Lend 并“借出了比预期更多的 $sUSDe”，从而推高了 USDe 的价格。同样，攻击者将 sUSDE 存入 DeFi 协议并借用 CRV。

On Wednesday, UwU Lend informed users that its team had identified the vulnerability. Per the post, it was a vulnerability unique to the sUSDE market oracle and had been resolved at the time of the report.

周三，UwU Lend 通知用户，其团队已经发现了该漏洞。根据该帖子，这是 sUSDE 市场预言机特有的漏洞，在报告发布时已得到解决。

As a result, the protocol was unpaused, and the markets were slowly relaunched to return to their normal operations. The DeFi project also announced it would repay all its bad debt and that users’ funds had not been lost during the exploit, claiming that their funds “are safu at UwU Lend.”

结果，该协议没有暂停，市场也慢慢重新启动，恢复正常运行。该 DeFi 项目还宣布将偿还所有坏账，并且用户的资金在利用过程中并未丢失，并声称他们的资金“在 UwU Lend 是安全的”。

Do You Get DéFì Vu?

你有 DéFì Vu 吗？

What seemed to be the end of the story turned out to be the first installment of a saga. On Thursday, reports of a second attack on UwU Lend appeared as the protocol carried out its reimbursement process.

看似故事的结局，结果却是传奇的第一部分。周四，在该协议执行报销流程时，出现了有关 UwU Lend 遭受第二次攻击的报道。

According to the reports, the same attacker drained another $3.7 million from the DeFi protocol before converting the funds to ETH again. The affected pools included uDAI, uWETH, uLUSD, uFRAX, UCRVUSD, and uUSDT.

据报道，同一攻击者从 DeFi 协议中又窃取了 370 万美元，然后再次将资金转换为 ETH。受影响的矿池包括 uDAI、uWETH、uLUSD、uFRAX、UCRVUSD 和 uUSDT。

The crypto community expressed their concern about the second attack, with many questioning if their funds were indeed safe. Users started to joke that funds were not “safu” but were “with Sifu” instead.

加密社区对第二次攻击表示担忧，许多人质疑他们的资金是否确实安全。用户开始开玩笑说资金不是“safu”而是“with Sifu”。

UwU Lend was founded by Michael Patryn, also known as Sifu. Patryn was the co-founder of the now-collapsed QuadrigaCX. As reported by Bitcoinist, Canadian authorities were pursuing an unexplained wealth order (UWO) against Sifu for his involvement in the exchange’s criminal activities.

UwU Lend 由 Michael Patryn（也称为 Sifu）创立。 Patryn 是现已倒闭的 QuadrigaCX 的联合创始人。据 Bitcoinist 报道，加拿大当局正在对 Sifu 实施不明财富令（UWO），因为他参与了交易所的犯罪活动。

The DeFi project has paused the protocol for the second time this week, and the situation is being investigated. However, online reports claim that the second exploit was caused by a vulnerability similar to the first attack.

本周，该 DeFi 项目已第二次暂停该协议，目前情况正在调查中。然而，在线报告声称第二次攻击是由与第一次攻击类似的漏洞引起的。

MetaTrust Labs explained the hacker seemingly used 60 million uSUSDE obtained from Monday’s hack “as collateral to drain the pool.”

MetaTrust Labs 解释说，黑客似乎使用了从周一的黑客攻击中获得的 6000 万美元“作为抵押品来耗尽资金池”。

The news caused users to wonder whether the UwU Lend team was unaware of the tokens in the attacker’s wallet. Some also questioned why they didn’t stop supporting the sUSDE collateral.

这一消息让用户怀疑 UwU Lend 团队是否不知道攻击者钱包中的代币。一些人还质疑为什么他们不停止支持 sUSDE 抵押品。

At the time of writing, an official explanation for the second exploit has not been published.

截至撰写本文时，尚未发布对第二个漏洞的官方解释。