On June 13, 2024, UwU Lend suffered a second $3.7M exploit three days after a $20M hack on June 10. The attacker reused sUSDe tokens stolen in the first exploit as collateral to drain additional pools (uDAI, uWETH, uLUSD, uFRAX, uCRVUSD, uUSDT) because the protocol failed to freeze compromised collateral or revoke stolen token permissions between incidents.

After the attack on June 10, UwU Lend was exploited again by the same attacker, resulting in a loss of $3.72 million. The attacker held a significant amount of USDE tokens obtained from the first attack, which allowed them to leverage the remaining USDE funds and drain other UwU lending pools.