The Terra chain encountered a significant security breach resulting in reported losses exceeding $5 million, involving USDC and Astroport tokens. On Wednesday, July 31, the Terra Luna chain underwent a temporary pause due to a suspected exploit.
The network’s official X account announced the scheduled halt at block height 11430400. Transactions were temporarily suspended during this period while developers and validators worked to identify and resolve the issue.
Overview of Terra Chain Security Breach
Terra's team warned users about the imminent chain halt at block height 11430400, signaling a suspension of transactions. Concerns were raised regarding a potential hack on Terra, and assurances were provided that corrective actions would be taken. Collaborative efforts with Terra validators, particularly phoenix-1, were announced to deploy an emergency patch to address the suspected exploit.
The hack exploited a vulnerability in a third-party module named IBC hooks, responsible for cross-chain contract interactions and token transfers. This exploit enabled the attacker to siphon value from bridged assets, impacting tokens like USD Coin (USDC) and Astroport. Preliminary estimates indicate a potential compromise of approximately $5 million in tokens.
Following the breach disclosure, the price of Terra Luna Classic (LUNC) experienced a significant drop of over 4%. Despite the initial decline, LUNC showed signs of recovery. The latest update revealed a 2.84% reduction in LUNC's price, stabilizing at $0.00008116.
Analysis of Terra Chain Hack: $5M Loss Incident
The Terra chain fell victim to a major security incident due to an unaddressed vulnerability that allowed an attacker to mint tokens transferred through Inter-Blockchain Communication (IBC) onto Terra. This vulnerability emerged at a critical juncture coinciding with essential deadlines in the Terraform Labs bankruptcy proceedings.
The exploit involved a complex process utilizing a smart contract, IBC hooks, and a timeout mechanism. By leveraging these components, the attacker gained unauthorized access to substantial assets, including 500,000 USDT and 2.7 BTC. Investigations are ongoing to determine the exact nature of the exploit and to rectify the vulnerability.
The attack unfolded through a sequence where a smart contract was established on the Terra blockchain and invoked via an IBC transfer that timed out, redirecting tokens to the attacker's account. Despite transaction limits of 56 LUNA and 7,800 USDC per transfer, the attacker managed to extract millions of dollars in assets.
Efforts are underway by the Terra team and Astroport to comprehend the exploit fully and mitigate future risks. Astroport has committed to collaborating with other chains and Cosmos builders to evaluate and implement necessary measures, promising updates as more information surfaces.
Continuation of Terra Chain Operations Post $5 Million Hack
Terra's team has resumed block production following the recent security incident. In a statement on X, they confirmed the restart of block production around 4:19 AM UTC and the completion of the emergency chain upgrade. Transactions are now processing as usual, allowing users to resume activities on the network.
Over 67% of Terra's validators have upgraded their nodes to prevent a recurrence of the exploit, with more validators expected to follow suit. However, specific details regarding the recovery of the stolen funds or the mitigation strategy for the breach have not been disclosed.
Note: This article aims to provide information and should not be construed as legal, tax, investment, financial, or any other form of advice.
