The team behind the UwU Lend protocol is offering a $5 million bounty to whoever identifies its attacker after they pulled off a second exploit on the protocol.

“Repayment deadline for the funds you stole has passed. 5 Million Dollar bounty to the first person to identify and locate you,” UwU wrote to the hacker in a June 13 onchain message after they didn’t transfer 80% of the stolen funds before UwU’s requested deadline of June 12 at 5:00 pm UTC.

UwU claims the $5 million bounty would be in Ether and would be paid out before funds are recovered or charges are laid. 

It comes as the same hacker pulled off a second $3.7 million exploit, stealing funds from UwU’s uDAI, uWETH, uLUSD, uFRAX, uCRVUSD and uUSDT pools on June 13, according to blockchain security firm Cyvers.

Cyvers said the two hacks were carried out by the same hacker wallet address “0x841…21f47.”

How it all unfolded

The first exploit saw $20.3 million wiped from a price manipulation attack on June 10.

UwU then requested the hacker to return 80% of the funds — allowing them to keep the remaining 20%. It also assured the hacker that they would cease legal action.

However, no response was received from the hacker, who went on to commit the second $3.7 million exploit shortly before UwU announced the $5 million bounty.

The second exploit occurred while UwU was starting to reimburse victims from the first $20.3 million exploit, which resulted from a price manipulation attack.

Over $9.7 million has already been repaid to victims, according to a UwU Lend X post.

Despite now losing a combined $24 million, the UWU Lend token (UWU) is only down 20% to $2.51 over the last week, according to CoinGecko.

It now boasts a market cap of $22.6 billion.

Nearly $19 billion in cryptocurrencies have been stolen since the first industry hack was reported in June 2011, a recent Crystal Intelligence report shows.

Source