Terraport Finance DeFi protocol hacked ten days after launch

Terraport Finance, a DeFi protocol on the Terra Classic network, was hacked for $2 million ten days after its official launch.

Announcement:

A breach was detected in the Terraport Liquidity wallet this morning. The Terraport team is currently investigating this breach and efforts have been made to secure the protocol. Further official press release will be released later. We appreciate the understanding…

— Terraport Finance (@_Terraport_) April 10, 2023

The developers reported that the attacker exploited a vulnerability in the liquidity wallet. The project team is currently investigating the incident.

According to on-chain data, Terraport lost about 9.7 million TERRA, 15.1 million LUNC and 5.5 million USTC.

Terraport just got hacked / rugged

Sad news for all $TERRA holders who just lost everything in a split second

Hopefully now you understand why I advised caution and said it should have been audited

All funds gone:https://t.co/0RcAvbQsm7https://t.co/bRLVclcIt5

— Crypto Susanna (@LUNCDAO) April 10, 2023

On March 31, the TerraCVita developers launched Terraport Finance. The protocol allows users to swap LUNA and USTC for LUNC, and then burn them. In the first week of the project’s existence, more than 100 million coins were burned in total.

One Twitter user urged Binance CEO Changpeng Zhao to freeze the stolen funds.

The head of the exchange advised writing to the security team directly, but later said that Terraport funds had not been deposited on the platform. According to him, the assets were sent to exchanges MEXC Global and KuCoin.

Our team reviewed the transactions. Our analysis shows no funds were deposited in Binance. Some of the hacked funds was deposited to MEXC and KuCoin. Not much we can do here.

— CZ ? Binance (@cz_binance) April 10, 2023

MEXC has already frozen deposits in LUNC. The project developers also reached out to other exchanges where the stolen assets may have been deposited.

UPDATE:

Sadly during the last few hours a hacker drained liquidity pools from Terraport.
We are currently working with community members and major exchanges to secure as many of these funds as possible and blacklist wallets. All funds have been tracked.
Thank you for your…

— Terraport Finance (@_Terraport_) April 10, 2023

“Unfortunately, over the last few hours the hacker drained Terraport’s liquidity pools. We are currently working with community members and major exchanges to secure as many assets as possible and blacklist wallets. All funds are being tracked,” the project’s statement said.

In April, CertiK analysts reported that in the first quarter of 2023 blockchain projects lost more than $320 million due to hacks and fraud.