Attackers used IBC hooks-related vulnerabilities to steal about $3 million in tokens on the Terra chain

The Terra blockchain has reported a security vulnerability on its network. An unknown attacker exploited a known vulnerability related to the third-party module IBC hooks, which is used for cross-chain contract calls and token transfers. The attacker used this vulnerability to steal funds from bridged assets, including USDC and Astroport tokens. Initial estimates suggest that tokens worth about $3 million may be affected. After discovering the incident, Terra implemented emergency measures to prevent further damage and ensure that no additional tokens were stolen while the vulnerability was resolved. It is reported that the vulnerability was discovered a few months ago and fixed across the Cosmos ecosystem in April. However, Zaki Manian, co-founder of Sommelier Finance, explained that Terra's upgrade in June did not include this patch, leading to the subsequent attack. (The Block) Earlier today, Terra tweeted that the Terra chain briefly stopped at block height 11430400 and no transactions would be processed during this period. Terra will work with validators on Terra (phoenix-1) to subsequently apply emergency patches to fix the suspected vulnerabilities.