Investigators from the news outlet and blockchain security firm Uppsala claimed to have used “forensic techniques for about a month after the collapse of Terra” to track down the attacker. In that sense, they concluded that the address behind UST’s collapse, called Wallet A, is managed by Terraform Labs.
Wallet A was created on May 7th on the Ethereum network. These dates coincide with the first attempt to break UST. As seen below, the investigators linked Wallet A on Ethereum and Wallet A (T) on the Terra network to a series of flows that enable the attackers to bring down UST and LUNA.
The flows are tracked to several addresses on Binance and Coinbase, and to other funds transferred to DeFi protocol Curve. The investigator claimed that Wallet A was behind a $150 million withdrawal from a liquidity pool on Curve created to maintain “the liquidity of the Terra blockchain”. The report claims:
Before and after this transaction, a large amount of UST was deposited into various exchanges around the world, accelerating depegging, and eventually a bank run occurred. For this reason, several blockchain analysis companies around the world are pointing out Wallet A as the attacker’s wallet.
As the attack occurred, the report claims that Wallet A received a “large amount of UST” from Wallet A (T) from the Terra blockchain. The interactions between these wallets are linked by their memos, and information required by exchange platforms to identify a specific user to allocate the transferred funds.
Furthermore, the investigators claimed that an entity within the Terra (Classic) ecosystem publicly identified itself as the owner of one of the wallets that allegedly participated in the attack, the LUNC DAO. They concluded:
Combining the above findings discovered through on-chain forensics, the Binance user memo ‘104721486’ wallet, LFG wallet, LUNC DAO wallet, wallet A(T), and wallet A that received UST from wallet A(T) are all It leads to the conclusion that the wallets are either owned by the same owner or managed by a single group. This means that Terraform Labs or LFG made a financial transaction that caused Terra to collapse on its own.
That’s not LUNC DAO’s wallet! That’s KuCoin’s hot wallet! It makes the whole report nonsense, because obviously two addresses are not linked simply by virtue of receiving money from KuCoin. All it means is they are both KuCoin users. Nothing sinister and nothing proven.
Nevertheless, the CoinDesk report could have real-world implications for Terraform Labs, its co-founders, and members of its staff. According to the report, the Seoul Southern District Prosecutors’ Office is “aware of the suspicious” funds flows linked to Wallet A and TFL.
A spokesperson from the Prosecutor’s Office told CoinDesk the following:
We are tracking the flow of problematic wallets and coins through an on-chain forensic technique. In addition to allegations of fraud, charges of breach of trust may be applied depending on the results of the investigation by (Do) Kwon.
At the time of writing, LUNA is $2.5 with a 2% profit on the 4-hour chart.