The attacker is apparently taking advantage of the fact that price oracles are mismatching the old LUNC token with the new LUNA token. This was confirmed by a Chainlink community member who said oracles are currently “reporting the price of the new Terra 2.0 $LUNA coin (~$9.80) instead of the original Terra Classic $LUNC coin (~$0.0001)”.
The report estimates that the exploit has already cost Mirror Protocol around $2 million, though as of yet it has not been completely confirmed. It is apparent however that mBTC, mETH, mDOT, and mGLXY pools have been drained of their liquidity.
Mirror Protocol is a DeFi platform that allows for the creation of synthetic assets that track the price of real-world assets, such as stocks. Its core contracts were deployed on Terra Classic, but its assets are available on Ethereum and Binance Smart Chain (BSC).
This is the second time Mirror has suffered from a major vulnerability. The previous bug in Mirror’s code was exploited “hundreds of times” since 2021 according to a tweet from a community member.
The first exploit allowed a user to unlock other users’ collateral on the protocol and pull it out themselves. Overall, the first exploiter got away with “well over $30 million” and was not noticed until May 2022.