Terra 2.0 hack — July 2024

On or about 31 July 2024 an attacker exploited a flaw in IBC hooks, a third-party Cosmos module that lets incoming ICS-20 token transfers trigger contract calls, on the Terra chain relaunched after the 2022 collapse and commonly called Terra 2.0. Beosin, quoted by CoinDesk, said the attacker exploited a reentrancy vulnerability in the timeout callback of ibc-hooks, which let the attacker create tokens rather than merely move existing ones, and then sell them into on-chain liquidity.

Validators halted block production at height 11,430,400 to apply an emergency patch. The chain was down for roughly four hours, with the fix completed at 04:19 UTC, and Terra said validators holding more than 67 percent of voting power upgraded their nodes before production resumed. Terra's announcement said it would work with validators to apply an emergency patch to remediate a suspected exploit.

Loss estimates disagree, and so does the attribution of them. The same basket of assets — roughly 60 million ASTRO, 3.5 million USDC, 500,000 USDT and 2.7 BTC — is credited to Beosin and valued at over $4 million by The Block, Unchained and CoinDesk, and credited to Cyvers and valued at approximately $5 million by CryptoSlate. The attacker bridged proceeds to Ethereum.

Zaki Manian of Sommelier said the underlying bug had been found by Composable Finance in April 2024 and patched across Cosmos chains, but that Terra's June upgrade did not include the fix. Astroport said its own contracts were not exploited and that ASTRO fell sharply, by roughly 55 to 62 percent depending on the outlet, because minted tokens were sold into its liquidity. No recovery, reimbursement or arrest has been reported.