UniLend was exploited due to a vulnerability, leading to the theft of approximately $200K (4% of TVL). The attacker used a flash loan to deposit 60 million USDC, manipulated collateral calculations, and exploited a contract bug in the health check process to inflate collateral value, withdrawing 60 stETH. The flaw stemmed from the faulty implementation of the userBalanceOfToken function. UniLend has since fixed the issue, paused V2 deposits, and offered a bounty to recover the funds. This incident underscores the critical importance of security for DeFi platforms and the need for thorough smart contract audits.