Blizz Finance hack — May 2022

Blizz Finance, a lending protocol on Avalanche, was emptied over the night of 12 to 13 May 2022 during the collapse of Terra's LUNA token. The cause was a price feed that stopped tracking reality rather than a flaw in the protocol's own code.

Chainlink's LUNA feed carried a minimum reportable price of about $0.10. When LUNA's market price fell through that floor during the Terra collapse the feed stopped updating and continued reporting roughly $0.10 while LUNA traded near $0.01. Anyone could buy LUNA on the open market for a fraction of the reported price, deposit it into Blizz as collateral valued at the stale figure, borrow out the protocol's other assets and walk away. Blizz said Chainlink pausing the LUNA oracle allowed several attackers to deposit millions of LUNA still valued at $0.10 by the oracle in order to borrow all the collateral, and that the protocol had been drained before the team could pause it because of its own timelock. Chainlink said its circuit breaker had been triggered automatically to protect against flash crashes and market manipulation.

Blizz's loss is reported at more than $8.3 million by The Record, with Halborn's analysis putting it at roughly $8.28 million. The same stale feed was exploited against Venus Protocol on BNB Chain the same night, with losses reported at about $11 million to $11.2 million. Combined figures above $20 million that circulate for this episode add the two protocols together and are not Blizz's own loss.

No stolen funds were recovered and no arrests have been reported. Blizz promised a post-mortem; the sources cited here do not document any subsequent shutdown announcement or compensation plan.