Terraform Labs may have caused UST to collapse

The collapse of the UST stablecoin and the Terra (LUNA) blockchain may have been the work of an inside job. This is what a report by the Uppsala Security released this Tuesday (14).

It appears that the company has identified the wallet behind the attack that caused the stablecoin to collapse. And according to the report, the address is connected and managed by Terraform Labs itself.

This address would have carried out the transfer of millions of UST to the Binance and Coinbase exchanges. Hence, the company urged authorities to investigate exchanges as well.

UST collapse – internal sabotage from Terraform Labs

The first part of the Uppsala Security investigation shows an address that would have carried out the attack on UST. The report presents the address as “Wallet A”.

Next, Uppsala shows two lines of investigation “owned or controlled by Terraform Labs (TFL) or the Luna Foundation Guard (LFG) itself, or their related parties”.

The investigation showed several accounts that were somehow involved in the attack. All of them were connected to each other, including some addresses on Binance and Coinbase. At the same time, the addresses exchanged UST, USDC and USDT with each other.

The first act that triggered the UST’s fall was a removal of liquidity. One of the wallets associated with Terraform Labs allegedly removed around $150 million from pools from the decentralized exchange (DEX) Curve, cutting off UST’s liquidity.

Shortly thereafter, the wallet exchanged $85 million in UST for USDC stablecoin. In the same way as in the first case, the address performed the operation in the same pool as Curve.

Movement of the wallet suspected of the attack. Source: Uppsala Security.

Then the wallet controller moved the USDC to an address on Coinbase. Uppsala has tried to track transactions, but this is difficult if the exchange does not reveal user information.

Without the help of Coinbase, Uppsala Security data shows that Wallet A transferred the funds through the Wormhole, a bridge that carries out operations between blockchains. The wallet sent tokens from the Terra network (UST) to the Ethereum network (USDC).

Moves on Binance

But Binance was not the only exchange used by the address. Wallet A also sent UST to an account on Binance.

This time, the account has a specific number linked to a destination memo: 104721486. ​​This account has been receiving UST since the beginning of the year, and as of May 25, it had received 124 million UST.

Much of these funds came from Wallet A which, in fact, deposited 108 million UST on May 7th. Coincidentally, it was on this day that the stablecoin began to lose its parity with the dollar.

“Wallet A deposited a total amount of UST 108,251,326 in memorandum 104721486 on May 7th alone, the day UST began to lose parity. In total, the wallet performed ten inbound transactions via the memo. This date coincides with the removal of $150 million of liquidity from UST in Curve’s pools, which raises the possibility that Wallet A and the memo are related to the case,” the Uppsala report reads.

The first address that transferred UST to the memo was identified as a wallet controlled by LUNC DAO, one of LUNA’s validators. A second wallet on Binance (Memo 100055002) received over 2.6 billion UST as of May.

Partners in Disaster?

Finally, the report connected all addresses and linked Wallet A and accounts on Coinbase with Terraform Labs. Binance memos were also linked in this transaction.

“As a result of analyzing various on-chain data about the Terra incident, we confirmed that not only wallet A, but also the wallet connected to it, was managed by Terraform Labs and related companies. there is a need for regulators to investigate related exchanges,” the company said.

Investigation connects addresses with UST collapse. Source: Uppsala Security.

But it is important to stress that the report is a preliminary or independent investigation. Therefore, it is still not possible to attribute any fault or bad faith to any of the aforementioned parties.

However, this is not the first time that suspicion has fallen on Terraform Labs. In early June, as reported by Cryptheory, Arcane Research stated that the institution had sold LUNA tokens before the UST crash.