The Terra blockchain reported a security exploit on its network that resulted in the theft of tokens.
An unknown attacker exploited a known vulnerability associated with a third-party module called IBC hooks, which facilitates cross-chain contract calls and token movement.
The perpetrator exploited this vulnerability to drain value from bridged assets, including USDC stablecoin and ASTRO tokens from Astroport Finance. Security firm Beosin estimated that over $4 million worth of tokens were impacted. Meanwhile, the price of ASTRO token has dropped 60% following the incident.
Following the discovery of the incident, Terra implemented an emergency measure to prevent further damage and ensure no additional tokens could be stolen while the breach was being addressed. Terra coordinated with its validators to apply an emergency patch to remediate the suspected exploit.
“We will be working with the validators on Terra to apply an emergency patch thereafter to remediate a suspected exploit,” Terra stated.
The vulnerability was identified a few months ago and patched across the Cosmos ecosystem in April. However, a later upgrade in June on Terra failed to include this patch, leading to renewed exposure and the subsequent exploit, Zaki Manian, co-founder of Sommelier Protocol, explained.
“There was a vulnerability in IBC hooks discovered by Composable Finance in April. It was patched across Cosmos. Terra was patched then,” Manian told The Block. “It appears that Terra’s June upgrade did not include the patch. All the Axelar USDC bridged to Terra was stolen using the IBC hooks exploit. A large amount of ASTRO was also stolen.”
Terra was hard forked from the Terra Classic network following a major financial collapse in 2022, which was triggered by its algorithmic stablecoin, UST, losing its supposed peg to the US dollar.
