Terra Can’t Catch a Break as Blockchain Gets Exploited for $6 Million

The Terra blockchain was exploited for more than $6 million, causing developers to momentarily pause the chain.

Cybersecurity firm Beosin reported that the protocol lost 60 million ASTRO tokens, 3.5 million USDC, 500,000 USDT, and 2.7 BTC or $180,000.

Terra developers paused the chain early Wednesday to apply an emergency patch that would remediate the attack. Moments later, a 67% majority of validators upgraded their nodes and resumed block production.

The ASTRO token plunged as much as 75%. It now trades for $0.03, a 25% drop on the day. Traders who took advantage of the dip are now up 195%.

The vulnerability that drained the Cosmos-based blockchain was disclosed in April and involved deploying a malicious CosmWasm contract. It opened the door for attacks through what's called a “reentrancy vulnerability in the timeout callback of ibc-hooks,” which is used to call back contracts and enable cross-chain swaps.

Terra 2.0 also suffered a huge dip in total value locked (TVL) in April, shortly after the vulnerability was discovered. It nosedived 80% to $6 million from $30 million in TVL, and has since lost nearly half of that value, currently sitting at $3.9 million.

The current Terra chain emerged from the rubble as a hard fork after the original blockchain, now called Terra Classic, collapsed in 2022. Terra collapsed after its algorithmic stablecoin (UST) lost its peg, causing a run on deposits. More than $50 billion of UST’s market capitalization was wiped out in a matter of days.

Terraform Labs, the company behind the blockchain, has been slowly resolving its legal issues since collapsing in mid-2022. Founder Do Kwon awaits sentencing in Montenegro after he and his company were found liable for $40 billion in customer funds in early April.

On June 12, Terraform Labs settled with the SEC for $4.4 billion, for which the company will pay roughly $3.59 billion plus interest and a $420 million penalty. Meanwhile, Kwon will pay $204.3 million, including $110 million in disgorgement, interest, and an $80 million penalty, a court filing showed.