Terra Blockchain Exploit Drains Over $4 Million in Tokens

The Terra blockchain was halted Wednesday morning after an exploit drained millions of dollars worth of tokens.

In a tweet, Terra stated that the blockchain would halt at block height 11430400 to enable validators to apply an "emergency patch" to address the exploit.

Following the blockchain halt, the network resumed block production at around 4:19am UTC, per a tweet from Terra, with validators holding over 67% of voting power on the chain having patched their nodes against the exploit.

According to blockchain security firm Beosin, the attack saw over $4 million in tokens drained from bridged assets, including around 60 million ASTRO tokens and 2.7 BTC, along with $3.5 million in USDC and $500,000 in USDT stablecoins.

Following the exploit, the price of Astroport's ASTRO token plummeted to an all-time low of $0.01314, and is currently trading at $0.0218, down over 53% on the day, per data from CoinGecko.

Terra's own LUNA token, meanwhile, settled at around 2.7% down on the day, at $0.3944, after dipping to $0.385 in the immediate aftermath of the exploit.

Per Beosin, the attack exploited a known vulnerability and involved the deployment of a malicious CosmWasm contract. The potential exploit was disclosed and involves a "reentrancy vulnerability in the timeout callback of ibc-hooks," part of the inter-blockchain communication (IBC) protocol used to initiate contract calls and enabling cross-chain swaps.

Terra (LUNA), also known as Terra 2.0, is a hard fork spun off from the original blockchain, dubbed Terra Classic (LUNC), in the wake of the 2022 collapse of the Terra ecosystem. The collapse was precipitated by the failure of Terra's algorithmic stablecoin, UST, and sparked contagion across the crypto ecosystem.

Edited by Stacy Elliott.