Blockchain security firm Cyvers Alert reported a significant exploit on the DeFi lending protocol UwU Lend, which resulted in an approximately $19.5 million loss.

The attacker funded their wallet via the sanctioned crypto mixer Tornado Cash.

Cyvers co-founder and CTO Meir Dolev told CryptoSlate in a June 10 statement:

“The UWU lending contract was exploited by an attacker that executed three transactions in six minutes and drained approximately $20 million.”

On-chain data reveals that the attacker’s wallet moved several digital assets, including wrapped Ethereum (WETH), wrapped Bitcoin (WBTC), and stablecoins like USDC. The attacker’s address has been tagged as the UwU Lend Exploiter on Etherscan.

Web3 security firm PeckShield further corroborated the incident, adding that the root cause of the attack was a price oracle issue. It said:

“In particular, the sUSDe asset is priced as median from multiple sources. Five of them, i.e., FRAXUSDe, USDeUSDC, USDeDAI, USDecrvUSD, and GHOUSDe, were manipulated during the hack.”

Meanwhile, UwU Lend confirmed the incident and immediately paused its platform. The protocol said:

“[We are] taking all necessary steps [and] doing our best here. Stay tuned for further updates.”

TVL surge?

Despite the exploit, the total value of assets locked on the DeFi protocol UwU Lend surged by 135% in the last 24 hours.

Data from DeFiLlama shows that UwU Lend currently holds over 82,000 ETH, valued at $305 million. However, approximately $247 million of these funds are borrowed.

UwU Lend was developed by Michael Patryn — also known as Sifu or 0xSifu — the controversial founder of the defunct Quadriga CX exchange. The platform enables depositors to provide liquidity to earn passive income, while borrowers can obtain liquidity in an over-collateralized manner. Additionally, liquidity providers supply liquidity and earn revenue by staking their LP tokens.

A recent hack on the GALA token that minted billions of extra tokens has caused a stir in the Gala community. But the Gala team responded quickly, drafting a proposal to upgrade their token contract and balance out the token supply. This proposal has already passed, and we should see the new token contract within the next couple of days.

I don’t think this was quite what Gala Games had in mind when they talk about May Mayhem! Earlier this week, someone with admin access to the GALA token contract managed to mint 5 billion fresh, new GALA tokens. They then sold a significant portion of those tokens before they were caught and their wallet shut down!

At the moment, it’s not entirely clear if this was an internal hack, or a vulnerabilitiy in the contract or company process.

This hack resulted in the minting of 5 billion (yes, billion) GALA tokens, of which approximately 600 million were sold netting a cool $20+ million for the hacker! But while 20 million sounds nice, Gala has already contacted the FBI, the DOJ, and other such authorities. So the hacker may not have long to enjoy their ill-gotten gains!

You can read the official announcement from Gala Games about the incident here.

Update: Apparently the ETH from the sold tokens was recovered and is now converted back into GALA tokens.

No Worries! All is Well!

As a fix for this issue, the Gala Games team proposed to upgrade their existing GALA token contract. This upgrade will not only make the contract more secure, but it will also include a burn of about 5 billion tokens (the same exact amount minted by the hacker), by sending them to a burn address.

The proposal was only open for 24 hours. It has already passed a vote among those who own Gala Games Founder Nodes. Implementation should occur within the next few days.

And though the hack was discovered quickly, the bleeding stopped, and a proposed solution already well on its way to being implemented, this incident does highlight some of the issues with what is still a very new and ever-changing landscape of blockchain technology. Not only are smart contract audits an important part of the space, but developers also need to make sure and provide adequate security against malicious actors with access to sensitive functions (such as minting new tokens!).

And this is not the first time Gala has run into issues with their token. They already had to create an entirely new token (Gala v2), due to internal disputes among the team. And though the value of the GALA token has already rebounded from this incident, a new bloody nose for Gala Games is not going to help the growth and adoption of their blockchain ecosystem.

But, they did respond quickly, and as far as the average user knows, nothing has really changed.

What is Gala Games?

Gala Games is a produce, developer, and blockchain ecosystem for web3 gaming. This includes in-house games, as well as partnerships with other developers. Their games include Spider Tanks, Mirandus, Superior, Town Star, and many others. They also purchased Ember Entertainment, a mobile gaming company, and have begun integrating NFTs into their existing portfolio of mobile games.

But Gala includes more than just games. They have launched projects for distributing Music and Film as NFTs! Gala Games also built their own blockchain. This chain is called GalaChain (formerly GYRI), and will be the future home for all Gala-related apps and games.

Gala is a strong proponent of distributed ecosystems. And so, to support that concept, they offer user-run server nodes for both their blockchain and for many of their game as well. And, of course, they have their own token GALA, which is available on both the Ethereum network and on GalaChian.

To learn more about Gala Games, follow them on Twitter, join their Discord, and visit their website.

The sensational cryptographic hack targeted a blockchain network that supports popular GameFi Axie Infinity. The hackers escaped with around $625 million worth of Ethereum and USDC.

Multi-million dollar hack involving the Axie Infinity game 

The recent hack of the popular DeFi game Axie Infinity may be considered one of the largest cryptocurrency thefts in the history of cryptocurrencies, and certainly the largest against decentralized finance.

According to initial findings from the ongoing investigation, the hacker used hacked private keys to forge withdrawals from the Ronin Bridge, stealing 173,600 ETH and $25.5 million in USDC. 

The hackers breached the cybersecurity of the Ronin Network, the independent Ethereum blockchain developed in-house by the publishers of the hugely successful and popular video game Axie Infinity.

According to a post on Ronin Network’s official blog, the attack specifically targeted the network validation nodes for Sky Mavis, the publishers of Axie Infinity and Axie DAO.

Reassurances from Axie Infinity

The lengthy statement on the company blog reads:

“The Ronin bridge has been exploited for 173,600 Ethereum and 25.5M USDC. The Ronin bridge and Katana Dex have been halted. We are working with law enforcement officials, forensic cryptographers, and our investors to make sure all funds are recovered or reimbursed. All of the AXS, RON, and SLP on Ronin are safe right now”.

Axie Infinity co-founder Jeff Zirlin was at an NFT conference in Los Angeles. While on stage, Zirlin said:

“We realized that the Ronin network has been exploited for 173,000 Ethereum and about $25 million in USDC”.

With the hope of someone who really believes this, he then added:

“This is one of the biggest hacks in history. We believe in a future of an Internet that is open and owned by users”.

Past hacker attacks

Last year, an anonymous group of hackers managed to steal around $600 million in cryptocurrency from Poly Network, in what was dubbed as the biggest theft in cryptocurrency history. After a short time, more than half of the loot was returned.

In the whole of 2021, according to analyst firm Chainalyisis, crypto scams would have yielded something like $14 billion. This exponential growth, according to the analyst firm’s experts, is largely due to the growth of decentralized finance platforms, whose volumes grew by 912% year-on-year.

Chainalysis in its annual Crypto Crime report wrote:

“DeFi is one of the most exciting areas of the wider cryptocurrency ecosystem, offering huge opportunities for both entrepreneurs and cryptocurrency users”.

In detail, cryptocurrency theft increased by 516% over what was recorded in 2020, equating to approximately $3.2 billion in cryptocurrency. Of this total, 72% of the stolen funds were taken from DeFi protocols.

Related posts
More from author