Last month, Terraform Labs caught the attention of the entire crypto community. In just a few days, the prices of the company’s two proprietary digital assets depreciated, and the only solution to get out of the crisis was a failed relaunch.
A recent investigation by blockchain security company Uppsala Security revealed that the wallet behind the attack was managed by Terra itself.
Last month, Terra’s algorithmic Stablecoin (UST) lost its peg to the dollar, after which the prices of both assets plummeted to near zero in a matter of days, causing panic and sell-offs throughout the market.
The first part of Uppsala Security’s investigation revealed the address that was linked to the first attack against UST and the destruction of its peg to the dollar.
The company named it “Wallet A” and determined that it may be “owned or controlled by Terraform Labs (TFL) or Luna Foundation Guard (LFG) or related entities.”
The investigation highlighted several accounts that were involved in one way or another. All of them were related to each other, several accounts were registered on Binance and Coinbase. It was also confirmed that they were transferring UST, USDC and USDT between each other.
The first action that triggered the de-linking occurred when “a TFL-linked wallet removed approximately 150 million UST liquidity from the Curve pool.” Later, in the same Curve pool, wallet A exchanged 85 million algorithmic stackcoins for USDC and transferred the new funds to a Coinbase user address, whose actions are difficult to trace because the exchange does not disclose user information.
Nevertheless, Uppsala Security data shows that funds to wallet A on the main Ethereum network came from the main Terra network via Wormhole. The corresponding wallet on Terra was identified as “terra1yl” (wallet A(T)).
Wallet A(T) was contributing UST to a specific account on Binance, associated with a destination tag (Memo) number 104721486. It began receiving USTs this year and by May 25 it had nearly 124 million USTs, most of which came from the A(T) wallet.
On May 7, 2022 alone, the day the UST tethering began, the A(T) wallet deposited a total of 108,251,326 UST into Memo: 104721486. A total of 10 incoming transactions were made to Memo 104721486 until 07/05/2022 21:44 UTC, when TFL first removed 150 million UST liquidity from the Curve pool, raising the possibility that Wallet A(T) and Memo: 104721486 may have been aware of the impending withdrawal of UST liquidity.
The first address that transferred UST to Memo: 104721486 was identified as a LUNC DAO-controlled wallet (thanks to a tweet from the team itself). This address (terra13s) had previously sent 19 million LUNA to another wallet (terra17p), which in turn transferred 100 million LUNA to (terra1gr), an LFG-controlled wallet, according to the confirmed data.
Another user wallet on Binance (Memo: 100055002) received 2,665,579,215 UST through May, and terra13s along with terra1t0 were the first to deposit funds there. The second figure shows the connection between all the addresses in more detail. Commenting on the findings, Uppsala Security CEO Kim Hyun-woo noted:
Through analysis of various onchain data about the Terra incident, it was confirmed that not only Wallet A, but also the wallet connected to it, was operated by Terraform Labs and related companies. Apparently, regulators need to question the exchanges involved as well, such as Binance.