Original Author: Nansen
Original compilation: Foresight News
Nansen's research team delved into the UST unpegging problem and used the results of the on-chain tracking to dispel the rumors circulating on the Internet that the Terra network crash was caused by a single malicious attacker.
Summary of Findings
Through on-chain investigations, we found that a small number of giant whales discovered loopholes in the early stage of UST unanchoring, especially the relatively shallow liquidity of Curve pools linked to TerraUSD (UST) and other stablecoins, and exploited these loopholes in the following ways.
1. Withdraw UST funds from Terra's Anchor protocol
2. Bridge these funds from Terra to Ethereum through the Wormhole cross-chain infrastructure.
3. Exchange a large amount of UST for other stablecoins in Curve's liquidity pool, and in the process of unanchoring, through the non-effective price difference between the CEX and DEX markets, in various pricing sources (Curve, decentralized arbitrage between centralized exchanges and centralized exchanges).
Thus, we find strong evidence that the popular claim that there was an "attacker" or "hacker" whose breach caused the UST to unanchor does not hold water. The de-anchoring of UST may have been caused by the divestment of several well-funded entities.
indirect
Given the suddenness of UST's de-pegging, many market participants, whether directly affected or not, are anxious to understand the sequence of events that led to the loss of UST's peg. To shed light on these events, Nansen compiled an in-depth report, using on-chain data from Terra and Ethereum, to reconstruct the on-chain history that led to the loss of the algorithmic stablecoin's dollar peg earlier this month.
Where possible, we want to give an objective description backed by on-chain evidence. Additionally, we leverage Nansen's labeling approach to add some visual distinction to wallets and flag entities whose on-chain behavior may have affected the unpegging mechanism.
This study does not include potential off-chain events that could cause UST to lose its peg. The impact on investors, the breakdown of net losses between wallets, and the question of what happened to the BTC reserves backing UST are outside the scope of this report.
On-chain trace tracking
Briefly, we define on-chain analysis as the method of using information from the blockchain ledger to determine the sequence of events associated with the depeg of UST. More specifically, on-chain analysis involves looking at transaction data and cryptocurrency wallet activity -- two sources of data that are useful when trying to piece together events surrounding the depeg.
We started the study using a fundamental theory approach, and the relevant transaction volume data informed the scope of the study. Through a review of gray literature such as social media and forum threads, we narrowed the scope of our study to focus on transaction data between May 7 and May 11, 2022. Results of the thematic analysis of the gray literature highlight the importance of trade flow activity to Curve's liquidity pools during this period, which in turn informs the order in which we conduct our analysis.
Our analysis proceeds in three stages.
In the first phase, we analyzed the transaction flow into and out of the Curve lending protocol. We have compiled a list of wallets whose transaction activity indicates that they may have affected the unpegging of UST.
The second phase of the analysis consisted of three parts: i) we observed any cross-chain transactions on the Wormhole bridge that could lead to UST being unanchored; ii) we reviewed UST outflows from the Anchor protocol, involving the list of observed wallets; iii) We investigate the sales of UST and USDC on centralized exchanges.
The third stage of analysis involved triangulating this combined on-chain evidence, which allowed us to piece together relevant activity and formulate a narrative that explained the UST unanchoring. We also identified a list of seven wallets most likely to play a significant role in the UST unpegging event:
0x8d47f08ebc5554504742f547eb721a43d4947d0a (EIP 1559 User)
0x4b5e60cb1cd6c5e67af5e6cf63229d1614bb781c (Celsius)
0x1df8ea15bb725e110118f031e8e71b91abaa2a06 (hs0327.eth)
0xeb5425e650b04e49e5e8b62fbf1c3f60df01f232 (Heavy Dex Trader)
0x41339d9825963515e5705df8d3b0ea98105ebb1c (Smart LP: 0x413)
0x68963dc7c28a36fcacb0b39ac2d807b0329b9c69 (Token Millionaire / Heavy Dex Trader)
0x9f705ff1da72ed334f0e80f90aae5644f5cd7784 (Token Millionaire)
Scramble on Curve
image description
Figure 1: The net balance value of UST on the Curve pool
When examining UST flows into and out of the Curve pool, two time periods stand out (Figure 1). March 2022 and the most recent period from May 7th to May 11th. We are particularly concerned about UST inflows, as UST de-pegging is said to be caused by excessive swapping of UST with other stablecoins, at least initially.
image description
Figure 2: UST price chart from January to April 2022
Between May 7th and May 8th, we observed UST diverging from its peg to the USD (see Figure 3), and we estimate that news of the removal of the peg began to circulate on social media shortly after that (see Figure 3). 4).
image description
image description
Figure 4: Screenshot of Do Kwon's personal Twitter, May 8, 2022
image description
Figure 5: Cumulative net flow from the first sign of an anchor to the Twitter newsfeed, aggregated into the Curve pool by timestamp
Between approximately 7 May 21:44 and 8 May 5:35 UTC (hours after Do Kwon's tweet, see Figure 4), the battle between UST inflows and outflows appeared to intensify.
At 21:44 UTC on May 7, a wallet related to Luna Foundation Guard (LFG) withdrew approximately 1.5 million UST from Curve (see Figure 6). Subsequently, an address (0x8d...7d0a, created prior to the incoming transaction and then used only for the exchange of Curve's UST for USDC, and for receiving and subsequently transferring USDC to Coinbase) inflowed approximately 85 million UST.
image description
Figure 6: Timeline of UST net flow to Curve, and the wallet address with the largest UST transaction volume at that time
image description
Figure 7: Net UST flows to Curve entities on May 7 and May 8, 2022, with highest inflows by wallet
The following four addresses are the top sources of inflow into Curve via 1inchDEX aggregators:
0x6b3d1a37b5c01901341f01f4975d31bc5e6c3d81 (D1), main label: masknft.eth
0x4f5f3d3f8eb2896e0e865cde934fe5103f979771 (D2), main labels: Heavy Dex Trader, NFT Collector
0x1df8ea15bb725e110118f031e8e71b91abaa2a06 (D3), main label: hs0327.eth
0x66b870ddf78c975af5cd8edc6de25eca81791de1 (K), main label: Oapital (also interacted with Curve directly)
Other wallets do a lot of transactions through Curve, albeit a little later. Wallet 0x99fd1378ca799ed6772fe7bcdc9b30b389518962 (N), which we have identified as being associated with Hodlnaut, is an example of these "early followers".
We then cross-referenced the wallets marked above with data from the Terra and Wormhole bridges to refine the scope of wallets that may have contributed to the UST unpegging.
image description
Figure 8: Large outflows on Anchor by tagged wallet address from May 7 to May 10
Between May 7th and 10th, we observed that the wallet with the most UST outflows from Anchor withdrew a total of over 347 million UST across 8 transactions. In total, the top 20 addresses have withdrawn a total of 2 billion UST from Anchor through a total of 5051 transactions.
Analyzing UST outflows from Anchor reveals that many of the Curve exchange wallets we previously flagged began withdrawing UST tokens from Anchor as early as April 2022. However, the spike in withdrawals from Anchor involving these wallets really started in mid-April of this year.
image description
Figure 9: Anchor outflows by Terra wallet and associated Ethereum addresses
Further analysis of the Anchor outflow highlights the importance of two wallet addresses that had a significant impact on UST's de-peg.
terra1yl8l5dzz4jhnzzh6jxq6pdezd2z4qgmgrdt82k (0x8d47f08ebc5554504742f547eb721a43d4947d0a on Ethereum, or the Curve UST inflow 「initiator」 (A))
terra195wtjmpjxhp336mclqfsyk2plvs8mw3lhsc5nc (0x4b5e60cb1cd6c5e67af5e6cf63229d1614bb781c or Celsius (B))
These two identified wallets initiated massive outflows from the Anchor protocol during the unanchor event (May 7-May 10), totaling approximately 420 million UST across 15 transactions. When cross-compared with the UST bridge from Terra to Ethereum, these two wallets are the top wallets to bridge via Wormhole.
Earlier Harbingers: The UST Bridge from Terra to Ethereum
image description
Figure 11: Price and volume of UST over time
image description
Figure 12: Daily transfers to Ethereum (UST token units)
When analyzing transactions from May 5 to May 8, we found that 984 unique Terra wallet addresses were active during this period. Most of the transaction volume is concentrated in a few wallets. For example, the top 10 wallet addresses accounted for more than 57% of the total UST transferred during that time period.
image description
Figure 13: Top 10 wallets (UST) from Terra to Ethereum by transaction volume, May 5-May 8.
Dig into Suspicious Wallets (May 5-May 8)
According to the on-chain data, we found that these wallets mainly interact with the Anchor protocol when they are on Terra. After bridging from Terra to Ethereum, they interacted with Curve and 1inch.
Below, we present some suspicious wallets that recorded a large number of transactions on the Wormhole bridge shortly before UST unanchored.
1. 0x8d47f08ebc5554504742f547eb721a43d4947d0a (A) (See Figure 7)
This wallet was created a while ago and then deployed on May 7th.
All transaction records are mostly related to UST and USDC and stopped on May 9th. The most notable transaction was the linking of over 85 million worth of UST to Ethereum on May 7th. These tokens were then sent to Curve and exchanged for approximately 84.5 million USDC.
We can link this wallet to Terra's "sister" address (terra1yl8l5dzz4jhnzzh6jxq6pdezd2z4qgmgrdt82k), one of the top wallets that bridged UST to Ethereum from May 5th to May 8th. As we discovered in our Anchor analysis, the wallet was responsible for 10 outflows from Anchor between May 7 and May 10, amounting to approximately $193 million.
2. 0x4b5e60cb1cd6c5e67af5e6cf63229d1614bb781c (B) or Celsius (see Figure 7)
This wallet will be active from late April 2022. Between April 21st and 25th, it bridged approximately 138 million UST tokens to Terra. Notably, the wallet bridged 175 million UST from Terra to Ethereum on May 7th. The wallet receiving funds from the corresponding Terra address is 0xf642ea51c645c48196d9831a5937e95b0e9b4f7f. It then sends the funds to another address (transaction) on the same day. Of the funds in this wallet, 125 million was exchanged for USDC on Curve in batches, with a total amount of 25 million. Celsius was a close counterparty who sent and received funds to the wallet, according to Nansen data.
Based on on-chain data, we can also link this wallet to the following Terra address terra195wtjmpjxhp336mclqfsyk2plvs8mw3lhsc5nc, which was the top wallet that bridged USDT from Terra from May 5th to May 8th. The wallet also interacted with Anchor to withdraw funds starting in late April.
3. 0x6b3d1a37b5c01901341f01f4975d31bc5e6c3d81 (D1) or masknft.eth (see The Battle of the Curve)
This wallet has over 62 transactions from December 2021. From the beginning of April to May 8th, this wallet bridged over 79 million worth of UST to Ethereum, and then exchanged mainly to USDC through several transactions through 1inch aggregator.
This wallet is related to terra1cn2fh0k8f5ywzjl2s947xrpdnnerfnkg9qg2r7, which we also highlighted when analyzing Anchor Protocol.
4. 0x1df8ea15bb725e110118f031e8e71b91abaa2a06 (D3) or hs0327.eth (see The Battle of the Curve)
Again, this wallet has received many transactions through Wormhole, some as early as January. On May 8, it bridged UST worth just over 20 million to Ethereum in a 1-1.5M UST transaction. This amounts to 1.6% of total outflows during the period.
This wallet is associated with terra1vlel4dpqldcwm7ztre3k03apcldeawpq98rah0, which also bridged transactions to another Ethereum address 0x6524b211ef8e4baf346f1b780b08a3811ee9f3cd in February and March. It is worth noting that this wallet exited Anker earlier than other wallets, with its latest transaction on May 1st.
5. 0x41339d9825963515e5705df8d3b0ea98105ebb1c (H) or Smart LP 0x413 (Figure 7)
According to Nansen's label, this wallet is Smart LP. This wallet bridged about 8.8 million (late January) and then bridged another 30 million worth of UST to Terra (February). Additionally, it grafted roughly the same amount onto Ethereum in 10 million and 20 million transactions on April 27 and May 8, respectively. The 20 million UST transaction can be traced back to Curve, which exchanged 20 million UST for USDC.
The wallet is related to terra1vca36gazapns38mvupa2pfjz0g39ekdgk0wnea. It was also spotted in our analysis of Anchor Protocol, with transactions throughout April and May. After May 7, it appears to have exited Anchor entirely.
6. 0x68963dc7c28a36fcacb0b39ac2d807b0329b9c69 (F) or Token Millionaire / Heavy Dex Trader (See Figure 7)
According to Nansen's label, this wallet is a Token Millionaire. This is a fairly new wallet that only started trading at the end of March 2022, and has interacted with wallets associated with Alpha Financial Labs. The wallet only recorded a transaction from Terra to Ethereum on May 8. These transactions were worth approximately 30 million UST in total, which was then swapped for Curve's USDC in 3 separate transactions. The wallet is related to terra17mh65gqelelxu9r5fyz9l56mx60zdg274fwe40.
7. 0x9f705ff1da72ed334f0e80f90aae5644f5cd7784 (J) or Token Millionaire / Heavy Dex Trader (See Figure 7)
The wallet made multiple transactions on May 8 and May 9, grafting a total of approximately 60 million UST to Ethereum. Subsequently, these funds were exchanged for USDT on Curve. The wallet is related to terra1hapgv57ytaaaatvz92k46fzwxs9m2zsdr46rph.
8. 0xeb5425e650b04e49e5e8b62fbf1c3f60df01f232 (C) or Heavy Dex Trader (see Figure 8)
The wallet received approximately 10.5 million UST on May 8, and the funds were exchanged for USDT on Curve. According to the data on the chain, the wallet is related to terra1autyehjkpl9r4h99qa4v66h2tz8589haw9uyxm, terra1rhds9ltx9t5wxq22v9x9j26pk9tuwyykwhm9gy and terra14geatm83tykw5v3uw6klkcwwqf00tfwk72dq6 2 related. These wallets bridged 9.1 million, 737,000, and 615,000 UST worth of approximately 10.5 million UST from Terra on May 7, matching transactions on Ethereum addresses.
After the Storm: Trading and Arbitrage on Centralized Exchanges
From May 1 to May 20, accounts on all centralized exchanges flagged by Nansen received a net inflow of approximately 225 million tokens, including Wormhole-UST and wrapped-UST. We use "UST" in this section to refer to aggregated Wormhole and wrapped tokens.
image description
Figure 14: UST total net value flowing to centralized exchanges
image description
image description
Figure 16: Top Wallets + Early Curve Swappers Sending USDC to Centralized Exchanges (May 1-May 10).
Given that most early curve swappers have already withdrawn USDC from pools, we review the largest USDC depositors on centralized exchanges from May 1st to May 20th. There, the familiar wallet appeared again.
We noticed that the wallet (A) address initiated the first significant UST inflow at 21:57 UTC (85 million UST) on May 7th, and received 84.5 million USDC in return, and at midnight and 1 am on May 8th The total amount of USDC was sent to Coinbase in several transactions between points UTC.
image description
Figure 17: Significant activity of Masknft.eth - (Binance to Curve MIM-UST) and (Curve 3pool-Binance).
Masknft.eth had a net outflow of 76.9 million UST to CEXs. We observed that the wallet purchased approximately 96.9 million UST (from 1inch) from Curve and quickly transferred it to Binance.
We also found several transactions (totalling about 11.9 million UST) on May 8, where masknft.eth transferred UST from Binance and swapped it for MIM on the Curve MIM-UST pool. While we cannot confirm whether these transfers to Binance were arbitrage transactions, our guess is that masknft.eth may have purchased UST on Binance during the unpegging period (UST hit a low of ~0. Sell on the Curve for a profit when the two-day peg manages to recover briefly.
image description
Figure 18: Key Activities of Oapital
The table above shows that Oapital alone exerted significant selling pressure on Binance and FTX, with most of the unloading activity taking place on Binance. Unfortunately, we were unable to match the source of UST received from the WormholeUST migrator contract address.
image description
Figure 19: Wonderland DAO’s UST deposits to Binance
In addition to the aforementioned suspicious addresses, we also noticed that Wonderland DAO sent 57.4 million UST to Binance between May 10th and 11th, after liquidating their Abracadabra Degenbox.
image description
in conclusion
in conclusion
Given the magnitude of the financial and psychological ramifications of the UST de-anchoring, many narratives of "what happened" have flooded the internet. Our analysis leverages on-chain data to decipher what happened before and during the UST unpegging. Through inspection of on-chain activity, we found that a small number of wallets and possibly even fewer entities behind those wallets contributed to an imbalance in the Curve liquidity protocol that regulates parity between UST and other stablecoins.
Seven wallets swapped large amounts of UST and other stablecoins on Curve as early as late May 7th (UTC). These seven wallets withdrew a large amount of UST from the Anchor protocol on and before May 7 (as early as April) and bridged the UST to the Ethereum blockchain through Wormhole. Of the seven wallets, six interacted with centralized exchanges, sending more UST (supposedly for selling), or for a subset of them, sending USDC from Curve’s liquidity pool .
This on-chain research disproves the notion that an "attacker" or "hacker" compromised UST. Instead, we found that a small number of players found and exploited bugs - specifically related to the shallow liquidity of Curve's pool, which led to the following events:
1. Withdraw UST funds from Terra's Anchor protocol.
2. Bridge these funds from Terra to Ethereum via the Wormhole infrastructure
3. Swap a large amount of UST for other stablecoins in the Curve liquidity pool
4. During the "unanchoring" process, some of these wallets may have taken advantage of inefficiencies and price differences between various pricing sources (Curve, decentralized exchange DEX, centralized exchange CEX), and between CEX and DEX Exchanges for arbitrage trading.
Epilogue: On-chain data, from forensics to risk management
Original link
