Mirror Protocol (2022) — Crypto Hack
LaunderedMirror Protocol was silently drained of $90M over 7 months via an oracle exploit that allowed minting of mAssets with near-zero collateral.
Summary
Mirror Protocol was silently drained of $90M over 7 months via an oracle exploit that allowed minting of mAssets with near-zero collateral.
How It Was Compromised — DeFi via Oracle Exploit
A vulnerability in Mirror Protocol's oracle-locking mechanism allowed an attacker to exploit the difference between Terra's oracle price feed and the actual token prices. By submitting governance proposals that affected oracle parameters, the attacker was able to lock in prices that allowed minting synthetic assets (mAssets) with far less collateral than required. The exploit went undetected from October 2021 to May 2022 when Terra's ecosystem collapsed.
Fund Flow & Laundering Analysis
Stolen funds converted to UST stablecoin before the Terra collapse rendered much of it worthless. The exploit was discovered post-mortem after Terra's ecosystem implosion. With Terra's collapse in May 2022, much of the remaining extracted value became worthless. Funds that had been bridged to Ethereum were partially tracked. Do Kwon and Terraform Labs faced legal proceedings unrelated but contextually significant.