DeFi protocol UwU Lend, founded by QuadrigaCX co-founder Michael Patryn, also known as “0xSifu,” recently lost over $19 million in a flash loan attack.

The Exploit

The incident occurred on Monday, when blockchain security firm Cyvers alerted users to the hack, noting an initial loss of around $14 million. Shortly thereafter, blockchain analytics firm Arkham estimated the total loss to be closer to $19.3 million. UwU Lend subsequently paused its protocol to investigate the situation.

Blockchain security firm Beosin identified the attacker used a flash loan to manipulate the prices of stablecoins USDe and sUSDe. Matthew Jiang from Blocksec suggested that the exploit stemmed from an improperly designed blockchain Oracle.

Response from 0xSifu

0xSifu, who founded UwU Lend in September 2022, sent a blockchain message to the hacker offering a 20% bounty on any funds taken, provided 80% of the stolen funds are returned. Sifu assured the hacker that they would face no legal repercussions if they complied by June 12 at 17:00 UTC. He also warned that if the hacker did not cooperate, the bounty would be extended to the public to identify the hacker for prosecution.

Interestingly, the hacker deposited much of the stolen funds into Curve Finance’s Llama Lend protocol, which was then used to borrow crvUSD. Curve Finance managed to liquidate the hacker’s position, successfully concluding what they termed an “unprecedented (and unplanned) test of LlamaLend resiliency.”

Background on 0xSifu

Michael Patryn, better known as 0xSifu, is infamous for his association with the collapsed crypto exchange QuadrigaCX. He resurfaced in the crypto world as the treasurer of Wonderland DAO but was ousted after being doxxed by blockchain sleuth ZachXBT. Following his removal, Sifu began sending funds to Tornado Cash, leading to speculation about the ownership of these funds.