What happened
On the morning of April 10th, Terraport was exploited resulting in losses of approximately 4 million USD in Terra, LUNC, and USTC tokens.
The hack was made possible due to a mathematical weakness in the algorithm used to calculate LP prices. The malicious actor added a minor amount of liquidity to the protocol and then manipulated the LP share price, allowing them to withdraw a large amount of liquidity. Two pools were affected, the first one drained for 9,148,426 TERRA ($1.8 million) and 15,100,861,997 LUNC ($1.88 million), and the second one for 576,736 TERRA ($115K) and 5,487,381 USTC ($117K).
The total losses amount to about $4 million USD.
Exploited Addresses:
terra19yrq0mehjfk5cquxn4svjxft4rmhcc9g8t0yma
terra1z5luj6qdtclnt5jnjkrtnlj9zankf654638dq2
Added liquidity:
Tx 1 bdd941…4aba 55b8c01c92d29b0Tx 2 8c23dc…63e1
Remove liquidity:
Protocol details
Evidence
- report @_Terraport_ incident report twitter.com
- report Report coingape.com
- analysis Web Archive archive.ph
- analysis DeFiLlama defillama.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
