UwU Lend 在 Oracle 操纵攻击中损失 1940 万美元

Cyvers 首先发现了该漏洞，披露了在六分钟内执行的三笔交易的复杂序列。

The former chief financial officer of Frog Nation, Sifu, lost $19.4 million in an oracle manipulation attack on his lending protocol, Uwu Lend.

Frog Nation 前首席财务官 Sifu 在对其借贷协议 Uwu Lend 发起的预言机操纵攻击中损失了 1940 万美元。

Cyvers, who discovered the vulnerability first, disclosed a complex sequence of three transactions carried out in under six minutes. The thieves used Tornado Cash to buy Wrapped Bitcoin (WBTC) and Dai (DAI), which they then turned into Ether (ETH).

最先发现该漏洞的 Cyvers 披露了在六分钟内执行的三笔交易的复杂序列。窃贼使用 Tornado Cash 购买了 Wrapped Bitcoin (WBTC) 和 Dai (DAI)，然后将其转换为 Ether (ETH)。

The decentralized finance (DeFi) system UwU Lend was the victim of a continuing crypto attack that gained approximately $20 million on Monday, June 10. It was the on-chain security company Cyvers who discovered the problem and posted on social media platform X to notify the community:

去中心化金融（DeFi）系统 UwU Lend 是持续加密攻击的受害者，6 月 10 日星期一，该攻击造成约 2000 万美元的损失。链上安全公司 Cyvers 发现了该问题，并在社交媒体平台 X 上发帖通知社区：

“Hey @UwU_Lend, someone is trying to get you! At this point, the address has received almost fourteen million dollars…”

“嘿@UwU_Lend，有人想抓你！至此，该地址已收到近一千四百万美元……”

Cyvers claims that a complex sequence of transactions led to an assault on UwU Lend, a liquidity market where users may deposit and borrow digital assets. Within an hour after the first alarm, the hack had grown to include almost $20 million in stolen cash.

Cyvers 声称，一系列复杂的交易导致了对 UwU Lend 的攻击，UwU Lend 是一个流动性市场，用户可以在其中存入和借入数字资产。在第一次警报发出后一个小时内，黑客攻击已经扩大到被盗现金近 2000 万美元。

Tornado Cash, a crypto-mixing technology, provided the funding for the lightning-fast and pinpoint assault. The hacker depleted around $20 million in only six minutes via three fraudulent transactions. Tornado Cash provided the attack’s funds, as Cyvers revealed two days prior to the exploit.

Tornado Cash 是一种加密货币混合技术，为闪电般快速且精准的攻击提供了资金。黑客在短短 6 分钟内通过三笔欺诈交易消耗了约 2000 万美元。正如 Cyvers 在攻击发生前两天透露的那样，Tornado Cash 提供了这次攻击的资金。

Peckshield claims that the sUSDe asset, which was valued using a median from many sources, has a pricing oracle flaw at its core. During the hack, the perpetrator modified five sources, leading to the vulnerability.

Peckshield 声称，sUSDe 资产采用多种来源的中位数进行估值，其核心存在定价预言机缺陷。在黑客攻击期间，犯罪者修改了五个源，导致了该漏洞。

El Salvador issued a draft for Bitcoin banking legislation

萨尔瓦多发布比特币银行立法草案

Ripple and Colombia’s Central Bank Investigate the XRP…

Ripple 和哥伦比亚中央银行调查 XRP……

Quickly halting its procedure and setting borrowing and deposit rates to 0% to safeguard user holdings, UwU Lend responded to the assault by pausing it. On their X page, the squad explained what they were doing right now and what they were looking into right now:

UwU Lend 迅速停止了其程序，并将借贷和存款利率设置为 0%，以保护用户持有的资产，UwU Lend 通过暂停来回应这一攻击。在他们的 X 页面上，该团队解释了他们现在正在做什么以及正在研究什么：

“We are now waiting for the hacker to respond to the offer we made. There will be no more changes to the procedure until the study is complete.”

“我们现在正在等待黑客对我们提出的提议做出回应。在研究完成之前，程序不会再有任何改变。”

In a bid to dismiss any charges, UwU Lend creator Michael Patryn—also known as 0xSifu—offered the hacker around $16 million in cryptocurrency. Through an on-chain message, he declared:

为了驳回任何指控，UwU Lend 创始人 Michael Patryn（又名 0xSifu）向黑客提供了约 1600 万美元的加密货币。他通过链上消息宣布：

“A 20% white hat reward on any funds stolen is on the table. We will not pursue this further, and you will not have any problems with police enforcement.”

“对任何被盗资金的 20% 的白帽奖励已经摆在桌面上。我们不会再追究此事，警方执法也不会有任何问题。”

Anyone who could identify the exploiter and assist in their apprehension would be eligible for the reward after the deadline had passed. The scenario became much more complicated when another person offered the hacker instructions on how to shift the cash undetected via an on-chain communication.

任何能够识别剥削者并协助逮捕他们的人都将有资格在截止日期过后获得奖励。当另一个人向黑客提供如何通过链上通信在不被发现的情况下转移现金的指示时，情况变得更加复杂。

Two addresses presently hold the stolen funds, which include substantial sums of WETH, WBTC, bLUSD, crvUSD, sDAI, CRV, DAI, USDT, and sUSDe. Roughly $23 million is the sum amount of the projected losses.

目前有两个地址持有被盗资金，其中包括大量 WETH、WBTC、bLUSD、crvUSD、sDAI、CRV、DAI、USDT 和 sUSDe。预计损失总额约为 2,300 万美元。

Also Read: Swan Bitcoin and Tucker Carlson Form a Partnership

另请阅读：Swan Bitcoin 和 Tucker Carlson 建立合作伙伴关系