UwU Lend hack
A June 2024 exploit of the DeFi lending protocol UwU Lend (founded by 'Sifu', Michael Patryn). An attacker used flash loans to manipulate the sUSDe price oracle and drained ~$19.4M, then hit the protocol again days later for ~$3.7M. Curve founder Michael Egorov was among those liquidated.
Also known as: UwU Lend, UwU Lend hack, Sifu
Summary
On June 10, 2024, UwU Lend was exploited for about $19.4 million. The attacker used flash loans to manipulate the price feed (oracle) for sUSDe across several stablecoin pools, then borrowed against the distorted prices to drain assets. A second, related exploit days later took roughly a further $3.7 million. [1][2][3]
Fallout
The price dislocation also triggered large liquidations of legitimate positions — notably Curve Finance founder Michael Egorov, who borrowed stablecoins on UwU Lend against CRV holdings. UwU Lend paused the protocol and worked on reimbursement. UwU Lend is associated with the pseudonymous "Sifu" (Michael Patryn), also linked to the earlier Wonderland/QuadrigaCX controversies. [1][2]
Bracketed numbers refer to the numbered sources listed below.
Sources (3)
- UwU Lend hit by $20M crypto hack — Cointelegraph
- Decoding UwU Lend's $19.4 Million Exploit — QuillAudits
- UwU Lend hit by another $3.7 million hack amid reimbursement efforts — Crypto Briefing
See also
- World Liberty Financial (WLFI) — Justin Sun token freezeProjectsWLFI, a DeFi project linked to Donald Trump and his family, blacklisted/froze the wallet of major investor Justin Sun in Sept 2025 — ~540–595M unlocked WLFI tokens (~$107M) plus ~2.4B locked. Sun sued, alleging an undisclosed admin 'blacklist backdoor'; WLFI denied it and threatened a countersuit. The dispute is ongoing.
- Gala Games exploitTokensOn May 20, 2024 an attacker abused a privileged minter account on the GALA token contract to mint 5 billion GALA (≈$200M+ nominal) and dumped ~600M of them for ~$22M of ETH before Gala froze the address. Gala Games called it an internal access-control failure; the attacker later returned the ~$22M.
- HEX / PulseChain (Richard Heart)
This page was last updated on Jun 15, 2026. View revision history.