Million

Terra

Security

Neutron

The Terra blockchain has suffered a significant breach involving a complex exploit that resulted in the theft of approximately $5 million in assorted cryptocurrencies. The specific assets stolen included approximately 60 million ASTRO tokens, 3.5 million USDC, 500,000 USDT, and 2.7 BTC. The smart contract audit firm Beosin revealed the nature of the breach in a <a href="https://x.com/BeosinAlert/status/1818548029416411279" target="_blank" rel="noopener nofollow">post</a> on X, stating, “Terra blockchain was exploited for ~60M $ASTRO, 3.5M $USDC, 500k $USDT, and 2.7 $BTC. 
<h2 id="terra-blockchain-hack-and-outage-what-happened">Terra Blockchain Hack And Outage: What Happened?</h2> 
Security researcher Rarma (@Rarma_) <a href="https://x.com/Rarma_/status/1818489754373308907" target="_blank" rel="noopener nofollow">confirmed</a> via X, “So yes, it appears this is the IBC hooks exploit from back in April.” By deploying and utilizing a malicious CosmWasm contract through IBC interactions, an attacker was able to repeatedly trigger the MsgTimeout within the IBC hook’s OnTimeout callback prior to the deletion of the packet commitment. On chains that use ibc-hooks to integrate ICS-20, this flaw could enable recursive execution of the OnTimeout callback’s logic within the transfer application. This can lead to scenarios where funds from the escrow account are lost or tokens are unexpectedly minted. 
The vulnerability, identified but not patched since April, allowed the attacker to manipulate the IBC transfer process, minting tokens on Terra using the exploited mechanism, then transferring them off the platform. “Terra isn’t patched, which allowed the exploit to occur. The exploiter could mint tokens that had been IBC transferred onto Terra by utilizing a contract, IBC call (with IBC hooks), and a timeout. 3.5 Million axlUSDC, 500k USDT, 2.7BTC, 60m ASTRO tokens. Terra and Neutron IBC relayer need to stop,” Rarma added. 
The researcher further clarified that “the IBC’d Assets were ‘re-minted’ with this exploit into the hacker’s wallet. They then IBC Transferred them OUT. The ‘minted’ tokens were ‘burnt’ on the way out. So, from a Chain, IBC and Relayer perspective, the exploited amounts of these tokens technically don’t exist on Terra anymore. The TVL for these tokens is completely fake.” 
Notably, the hacker already exited his stolen assets, not via Cosmos, but by bridging them back to <a href="https://bitcoinist.com/spot-ethereum-etfs-record-341-million-net-outflow/" target="_blank" rel="noopener ">Ethereum</a> and swapping them for Ether (ETH). 
In response to the security breach, the development team acted quickly, halting the blockchain to prevent further exploitation. The halt was announced to the community with specific details: “Please be advised that the chain will be halted shortly at block height 11430400 and transactions will not be processed during this time. We will be working with the validators on Terra (phoenix-1) to apply an emergency patch thereafter to remediate a suspected exploit.” 
Approximately four hours after the halt, the dev team <a href="https://x.com/terra_money/status/1818552290372206614" target="_blank" rel="noopener nofollow">deployed</a> an emergency patch to rectify the <a href="https://bitcoinist.com/crypto-exchange-wazirx-suspends-trading-service/" target="_blank" rel="noopener ">exploited vulnerability</a> and to reinforce the blockchain’s defenses. The update was crucial in resuming normal blockchain activities: “The Terra chain has resumed block production at approximately 4:19 AM UTC today, and the emergency chain upgrade is now complete. Transactions are now being processed, and users may resume normal activities. <a href="https://bitcoinist.com/lunc-revival-terra-community/" target="_blank" rel="noopener ">Validators</a> holding over 67% of the voting power on Terra have upgraded their nodes to prevent the exploit from recurring. More validators are expected to upgrade soon.” 
At press time, LUNC traded at $0.00008039, down -3.3% in the last 24 hours. 
<img loading="lazy" decoding="async" class="size-full wp-image-312896" src="https://bitcoinist.com/wp-content/uploads/2024/07/LUNCUSDT_2024-07-31_13-49-02.png?resize=1024%2C473" alt="Terra Luna Classic price" width="1024" height="473" srcset="https://bitcoinist.com/wp-content/uploads/2024/07/LUNCUSDT_2024-07-31_13-49-02.png?resize=1024%2C473?w=3628 3628w, https://bitcoinist.com/wp-content/uploads/2024/07/LUNCUSDT_2024-07-31_13-49-02.png?resize=1024%2C473?w=640 640w, https://bitcoinist.com/wp-content/uploads/2024/07/LUNCUSDT_2024-07-31_13-49-02.png?resize=1024%2C473?w=768 768w, https://bitcoinist.com/wp-content/uploads/2024/07/LUNCUSDT_2024-07-31_13-49-02.png?resize=1024%2C473?w=980 980w, https://bitcoinist.com/wp-content/uploads/2024/07/LUNCUSDT_2024-07-31_13-49-02.png?resize=1024%2C473?w=1536 1536w, https://bitcoinist.com/wp-content/uploads/2024/07/LUNCUSDT_2024-07-31_13-49-02.png?resize=1024%2C473?w=2048 2048w, https://bitcoinist.com/wp-content/uploads/2024/07/LUNCUSDT_2024-07-31_13-49-02.png?resize=1024%2C473?w=750 750w, https://bitcoinist.com/wp-content/uploads/2024/07/LUNCUSDT_2024-07-31_13-49-02.png?resize=1024%2C473?w=1140 1140w, https://bitcoinist.com/wp-content/uploads/2024/07/LUNCUSDT_2024-07-31_13-49-02.png?resize=1024%2C473?w=3000 3000w" sizes="(max-width: 1000px) 100vw, 1000px" data-recalc-dims="1">

Terra Blockchain (LUNC) Hit By $5 Million Hack And Outage: Details

Table of Contents

Bitcoinist

Other articles published on Aug 1, 2024

Abnormal 2,764% Imbalance Stuns XRP: What's Happening?

USDT Issuer Tether Reports Record Profit in Q2 2024

Crypto.com surpasses Coinbase in trading volume as institutional demand grows

Tron Network Records Significant Growth in Daily Active Addresses

Montenegro Court Decides to Extradite Do Kwon to South Korea

Bitcoin Surges Then Plummets

Join our free newsletter for daily crypto updates!