UwU Lend, a decentralized finance (DeFi) protocol born out of a fork of Aave and founded by QuadrigaCX co-founder Michael Patryn or “0xSifu,” fell sufferer to an exploit on Monday.

Blockchain safety company Cyvers first alerted customers to the hack in a put up on X, noting that the protocol had lost around $14 million as of 8 a.m. ET on Monday. Around half of an hour later, blockchain analytics company Arkham estimated that the total loss from the exploit changed into as soon as closer to $19.3 million.

The UwU Lend crew later posted an update asserting that the protocol had been paused while the field changed into as soon as being investigated.

Blockchain safety company Beosin stumbled on that the attacker frail a flash loan to swap stablecoin USDe for assorted tokens, manipulating the associated payment of USDe and sUSDe. Matthew Jiang, director of safety companies at Blocksec, instantaneous on the ETHSecurity Telegram channel that the root motive for this UwU Lend exploit changed into as soon as an improperly designed blockchain Oracle.

UwU Lend changed into as soon as founded by Patryn in September 2022 and had gathered $91 million in Total Rate Locked (TVL) before the exploit on June 10, in preserving with data from DeFLlama. The protocol permits customers to lend and borrow crypto, and distributes protocol funds to liquidity providers.

Patryn, who is easiest known for co-founding the collapsed crypto commerce QuadrigaCX, reappeared within the crypto scene when he served as treasurer of the Wonderland DAO below the pseudonym Sifu. After he changed into as soon as doxxed by blockchain sleuth ZachXBT in January 2022, he changed into as soon as ousted from his role after a neighborhood vote.

Rapidly after his removal, Sifu began sending funds to Twister Money, and while he claimed this changed into as soon as his accept as true with money, some market contributors speculated that these funds could well honest maintain belonged to the neighborhood.

Sifu has now sent a blockchain message to the hacker offering a 20% bounty of any funds taken in commerce for 80% of them being returned to the UwU Lend protocol.

“You can face no menace of us pursuing this extra and no menace of regulations enforcement components. In the event you to attain to a resolution now now not to partake within the voluntary return and total the course of by June 12 at 17:00 UTC, we will make better the bounty to the public and offer the stout 20% to the person that could well identify you in a approach that outcomes on your conviction within the courts. We can pursue you from all angles,” talked about Sifu within the message.

Interestingly, the hacker deposited worthy of the stolen funds into Curve Finance’s Llama Lend protocol, which the hacker then frail to borrow crvUSD. As per the most most up-to-date update from Curve Finance, lenders managed to inviting liquidate the hacker’s build.

“Unprecedented (and unplanned) test of LlamaLend resiliency successfully concluded: design worked exceptionally well,” wrote Curve Finance on X.