Terra Blockchain Hack

On July 31, 2024, the Terra blockchain experienced a major security breach due to a reentrancy attack, which led to the theft of over $4 million in various digital assets. The attacker exploited a known vulnerability in the timeout callback of IBC-hooks—an issue that had been disclosed in April 2024 but was unintentionally reintroduced during a network upgrade in June. Among the stolen assets were approximately $3.5 million in USDC, $500,000 in USDT, 2.7 Bitcoin (valued at about $253,000 at the time), and 60 million ASTRO tokens from the decentralized exchange Astroport.

In response to the exploit, Terra developers halted the blockchain at block height 11430400 to deploy an emergency patch, which was completed by 04:19 UTC. Validators representing over 67% of the network’s voting power promptly upgraded their nodes to prevent additional exploits. Despite these quick actions, the breach had immediate repercussions in the market. The ASTRO token saw a sharp 56% drop in value, while Terra’s Luna Classic (LUNC) tokens declined by 3.4% within 24 hours.

The incident, initially reported by blockchain security firm Beosin, shed light on Terra’s failure to apply a previously identified critical patch, raising questions about the blockchain’s update and audit procedures. The stolen funds were quickly bridged to the Ethereum network and converted into Ether, making recovery efforts significantly more difficult. This breach occurred amid Terraform Labs’ ongoing bankruptcy proceedings, further damaging confidence in Terra’s ecosystem. The event underscored the importance of timely security patches, thorough audits, and vigilance in maintaining the integrity of decentralized finance (DeFi) platforms.