Millions drained from Mirror Protocol due to a bug in the LUNC pricing oracle
A decentralized finance application built on the Terra blockchain (now Terra Classic), Mirror Protocol, has allegedly suffered yet another exploit as hackers were able to take advantage of a bug in the Terra Classic blockchain (LUNC).
Mirror Protocol faces severe exploitation
As per a May 28 post on the Terra Research Forum by a Terra community member and analyst, FatMan (Twitter @FatManTerra), an exploit on Mirror Protocol led by a bug in the LUNC pricing oracle resulted in a loss of at least $2 million, and there are possibilities of even more losses.The pricing oracle has a bug that tells the system that LUNC is worth roughly 5 UST when it is actually worth microcents. An attacker can now load up on $1.3 million in collateral for $1k in LUNC but can borrow to withdraw real assets.
The mBTC, mETH, mDOT, and mGLXY pools have all been emptied so far. If the Mirror team does not address the problem, an attacker may be able to drain all of the mAsset pools (such as mSPY and mAAPL, mAMZN, etc.)
The negligent behavior of the Mirror Protocol team is visible in its history of attacks. Last week, FatMan highlighted the list of attacks on the system.
$90M drained unnoticed
In October last year, Mirror Protocol gave in $90 million to an exploit on the old Terra chain, which went completely unnoticed this whole time until last week.When a user wants to bet against stock on the Mirror platform, they have to lock collateral, which includes TerraUSD (UST), LUNA Classic (LUNAC), and mirrored assets (mAssets), for a minimum of 14 days. After the conclusion of the trade, they can unlock their collateral to bring the funds back to the wallet.
Smart contract-generated ID numbers conduct the whole trade. However, the bug in the code resulted in Mirror’s lock contract failing to check when someone uses the same ID multiple times during withdrawal. This means that the perpetrator can withdraw funds without any authorization.
In October 2021, an unknown entity noticed that it could unlock hundreds of times more collateral than it had using a set of duplicate IDs. As per the available records, it drained around $90 million in total.
Continue reading by joining Cryptonary Pro
$997/year
Get everything you need to actively manage your portfolio and stay ahead. Ideal for investors seeking regular guidance and access to tools that help make informed decisions.
For your security, all orders are processed on a secured server.
As a Cryptonary Pro subscriber, you also get:
3X Value Guarantee - If cumulative documented upside does not reach 300% during your 12-month membership, you can request a full refund.
24/7 access to experts with 50+ years’ experience
All of our top token picks for 2025
On hand technical analysis on any token of your choice
Weekly livestreams & ask us anything with the team
Daily insights on Macro, Mechanics, and On-chain
Curated list of top upcoming airdrops (free money)
3X Value Guarantee
If cumulative documented upside does not reach 300% during your 12-month membership, you can request a full refund.
Our track record speaks for itself
With over 2.4M tokens and widespread misinformation in crypto, we cut through the noise and consistently find winning assets.
Our track record speaks for itself
With over 2.4M tokens and widespread misinformation in crypto, we cut
through the noise and consistently find winning assets.
Frequently Asked Questions
Can I trust Cryptonary's calls?
Yes. We've consistently identified winners across multiple cycles. Bitcoin under $1,000, Ethereum under $70, Solana under $10, WIF from $0.003 to $5, PopCat from $0.004 to $2, SPX blasting past $1.70, and our latest pick has already 200X'd since June 2025. Everything is timestamped and public record.
Do I need to be an experienced trader or investor to benefit?
No. When we founded Cryptonary in 2017 the market was new to everyone. We intentionally created content that was easy to understand and actionable. That foundational principle is the crux of Cryptonary. Taking complex ideas and opportunities and presenting them in a way a 10 year old could understand.
What makes Cryptonary different from free crypto content on YouTube or Twitter?
Signal vs noise. We filter out 99.9% of garbage projects, provide data backed analysis, and have a proven track record of finding winners. Not to mention since Cryptonary's inception in 2017 we have never taken investment, sponsorship or partnership. Compare this to pretty much everyone else, no track record, and a long list of partnerships that cloud judgements.
Why is there no trial or refund policy?
We share highly sensitive, time-critical research. Once it's out, it can't be "returned." That's why membership is annual only. Crypto success takes time and commitment. If someone is not willing to invest 12 months into their future, there is no place for them at Cryptonary.
Do I get direct access to the Cryptonary team?
Yes. You will have 24/7 to the team that bought you BTC at $1,000, ETH at $70, and SOL at $10. Through our community chats, live Q&As, and member only channels, you can ask questions and interact directly with the team. Our team has over 50 years of combined experience which you can tap into every single day.
How often is content updated?
Daily. We provide real-time updates, weekly reports, emergency alerts, and live Q&As when the markets move fast. In crypto, the market moves fast, in Cryptonary, we move faster.
How does the 3X Value Guarantee work?
We stand behind the value of our research. If the documented upside from our published research during your 12-month membership does not exceed three times (3X) the annual subscription cost, you can request a full refund. Historical context: In every completed market cycle since 2017, cumulative documented upside has exceeded 10X this threshold.
Recommended from Cryptonary
