Terra Blockchain Faces Security Exploit; $6.8M Worth of Tokens Impacted

The breach targeted a vulnerability within a third-party module known as IBC hooks, a critical component that facilitates cross-chain contract calls and token movements. This exploit allowed hackers to transfer assets, including USDC stablecoin and Astroport tokens, without authorization.

Initial Estimates of Impact

According to Cyvers Alerts, hackers have stolen 60 million ASTRO, 3.5 million USDC, 500,000 USDT, and 2.7 Bitcoin from the Terra blockchain. The total amount of reported losses has reached roughly $6.8 million. 

The vulnerability in the network’s timeout callback of IBC hooks allowed attackers to execute transactions repetitively, resulting in significant losses and potentially minting extra tokens.

Cyvers Alerts noted that this vulnerability was revealed in April of this year. However, Terra's recent upgrade in June failed to include the critical patch that had been implemented across the broader Cosmos ecosystem. This oversight left the platform exposed and paved the way for the exploit.

“We will be working with the validators on Terra to apply an emergency patch thereafter to remediate a suspected exploit,” Terra stated in their official announcement.