Nansen: Attack on Terra came from within

Analytical company Nansen, against the backdrop of many versions about the reasons for the collapse of the UST stablekin, put forward the version that the project fell victim to a group attack from the Terra ecosystem.

Research platform posted report “Demystification of TerraUSD De-Peg”. The company’s analysts clarified that, according to their investigation, from May 7 to 11, a group of seven well-funded wallets of the Terra ecosystem operated on the Terra and Ethereum blockchains.

According to the authors of the report, the attack on the stablecoin began with the Anchor protocol. In the beginning, seven wallets started withdrawing UST liquidity from Anchor, then moved liquidity to Ethereum via the Wormhole bridge, and later exchanged UST for other stablecoins in Curve liquidity pools. In the end, thanks to inefficient communication between Curve and several exchanges, an arbitrage opportunity was seized by unknowns, causing TerraUSD to break the peg to the US dollar.

The report lists the wallet addresses that were involved in the attack on TerraUSD:

1. 0x8d47f08ebc5554504742f547eb721a43d4947d0a (EIP user 1559) – with a notable $85M transaction in UST transferred to Ethereum on May 7th and then exchanged to Curve for approximately $84.5M;

2. 0x4b5e60cb1cd6c5e67af5e6cf63229d1614bb781c (Celsius), who transferred $175 million of UST from Terra to Ethereum on May 7th. Then he sent $125 million worth of UST to Curve, which were then exchanged for USDC in batches of $25 million;

3. 0x1df8ea15bb725e110118f031e8e71b91abaa2a06 (hs0327.eth) — on May 8, the wallet transferred UST for $20 million to Ethereum;

4. 0xeb5425e650b04e49e5e8b62fbf1c3f60df01f232 (Heavy Dex Trader) – On May 8, the wallet received about $10.5 million in UST, which was then converted into USDC on Curve;

5. 0x41339d9825963515e5705df8d3b0ea98105ebb1c (Smart LP: 0x413) — on May 8, combined UST for $20 million, which was then exchanged for USDC on Curve;

6. 0x68963dc7c28a36fcacb0b39ac2d807b0329b9c69 (Token Millionaire / Heavy Dex Trader), who made transactions in UST worth about $30 million on May 8, exchanging them for USDC on Curve;

7. 0x9f705ff1da72ed334f0e80f90aae5644f5cd7784 (Token Millionaire), who made numerous transactions between May 8 and May 9, transferring a total of $60 million from UST to Ethereum.

The authors of the report point out that a small number of such players were able to find out the vulnerabilities leading to the crash of Terra:

“This online research debunks the story of a single attacker or hacker working to destabilize the UST. Instead, we found that several players have identified and worked on vulnerabilities — especially in relation to the shallow liquidity of the Curve pools that peg UST to other stablecoins.”

Nansen analysts are confident that their report should help future blockchain security protocols prevent similar attacks from happening again. Recall that the fall of Terra occurred in three days and led to the default of a powerful and promising project with a huge capitalization.