.png)
Nansen's research team dives into the UST de-peg, using on-chain evidence to dispel the myth of a single malicious attacker on Terra.
Summary of Results
Our on-chain investigation revealed that a small number of players identified vulnerabilities early into the UST de-peg, specifically in the relatively shallow liquidity of the Curve pools securing TerraUSD (UST)’s peg to other stablecoins, and moved to exploit these by:
1. Withdrawing UST funds from the Anchor protocol on Terra
2. Bridging these funds from Terra to Ethereum via the Wormhole infrastructure
3. Swapping significant amounts of UST to other stablecoins in Curve’s liquidity pools
4. During the de-pegging process, likely arbitraging inefficiencies between various pricing sources (Curve, decentralized exchanges, and centralized exchanges) by buying and selling positions between CEX and DEX markets.
As such, we refute the popular narrative of one “attacker” or “hacker” working to destabilize UST. The de-peg of UST could instead have resulted from the investment decisions of several well-funded entities, e.g. to abide by risk management constraints or alternatively to reduce UST allocations deposited into Anchor in the context of turbulent macroeconomic and market conditions.
Introduction
Given the sudden nature of how the de-pegging of UST unfolded, many market participants – whether directly affected or not – were eager to understand the sequence of events that led UST to lose its peg. In an attempt to shed light on those events, Nansen has compiled an in-depth report leveraging on-chain data from both Terra and Ethereum to recreate the on-chain history that led the algorithmic stablecoin to lose its peg to the US dollar earlier this month.
Where possible, we aspire to give an objective account backed by on-chain evidence. Additionally, we leveraged Nansen’s labelling heuristics to add some color to wallets and flag the entities whose actions on-chain likely influenced the de-pegging mechanism.
This study does not cover potential off-chain events which could have contributed to UST losing its peg. The impact on investors, the breakdown of net losses between wallets, and the question of what happened to the BTC reserves backing UST are all important areas of further research out of the scope of this report.
Following the Trail
In simple terms, we define on-chain analysis as the method of using information from a blockchain ledger to determine the series of events related to the de-pegging of UST. More specifically, on-chain analysis involves looking at transaction data and crypto wallet activities - two sources of data that are useful when trying to piece together the events surrounding the de-peg.
We started our study using a grounded theory approach where relevant transaction volume data informed the scope of the study. Through a review of grey literature such as social media and forum threads, we narrowed the scope of our study to focus on transactional data between May 7 and May 11, 2022. Results from the thematic analysis of the grey literature highlighted the importance of transaction flow activities on Curve liquidity pools during this period, which in turn informed the sequence in which we carried out our analysis.
Our analysis was organized in three phases. In phase 1, we analyzed the transaction flow in and out of the Curve lending protocol. We compiled a list of wallets whose transactional activities indicated they may have impacted the de-pegging of UST. Phase 2 of the analysis involved three parts: i) we observed any transactions across the Wormhole bridge that could have led to the UST de-peg; ii) we reviewed the outflows of UST from the Anchor protocol involving the list of observed wallets; iii) we investigated the sale of UST and USDC on centralized exchanges. Phase 3 of the analysis involved the triangulation of this aggregate on-chain evidence, which enabled us to piece together relevant activities and formulate a narrative that explains the UST de-peg. We also identified a list of seven wallets most likely to have played a significant role in the UST de-peg:
The Battle of the Curve
We began our on-chain analysis with the Curve decentralized exchange protocol on Ethereum since our grey literature review marked it as the “starting point” of the UST de-pegging events. The assumption forwarded by social media was that the UST-3pool on Curve, a liquidity pool that allowed UST to be swapped for USDC / DAI / USDT, was depleted of liquidity by one main “actor” who was the primary cause of the de-peg.
Figure 1: UST net token balance by block timestamp, YTD 2022
Source: Nansen Query, Note: x axis excludes timestamps with 0 balanceWhen examining the UST flows in and out of aggregated Curve pools, two time periods visually stood out (Figure 1): March 2022 and the more recent May 7 to May 11 timeframes. We paid special attention to UST inflows as the UST de-peg supposedly resulted from excessive swapping of UST vs other stablecoins, at least initially.
We found multiple inflows to Curve of over 60m of UST tokens each in March 2022. Despite this flow volatility, the UST’s peg did not diverge significantly from parity in March 2022 (Figure 2).
Figure 2: UST candle price chart January – April 2022
Source: CoinDeskBetween May 7 and May 8, we observed that UST deviated from parity with the US dollar (see Figure 3), and we estimated that the de-peg news started to spread on social media shortly after that time (see Figure 4).
We specifically scanned for early and abnormally large UST inflows to Curve by timestamp and wallet, as well as repetitive inflows from the same wallet, or if we could spot a “network” of wallets accruing to the same “entity”.
Figure 3: UST intraday candle price chart May 7 – May 8, 2022
Source: CoinDeskFigure 4: Screenshot of Do Kwon’s Twitter profile, May 8, 2022, ~1 am CET
Source: TwitterWe charted the time series of net flows to aggregated Curve pools (we voluntarily did not restrict our analysis to the 3pool and included the 4pool and other entities labelled by Nansen as associated with Curve, e.g. Zap depository, see Figure 5).
Figure 5: Cumulative net flows to Curve pools from first signs of peg destabilization to Twitter news flow, aggregated by timestamp
Source: Nansen Query; The red areas correspond to the periods when the “UST peg defending wallets” withdrew UST tokensA battle between UST inflows and outflows appeared to intensify from approximately May 7, 21:44 to May 8, 5:35 UTC (a few hours after Do Kwon’s tweet, see Figure 4).
On May 7 at 21:44 UTC, a wallet associated with the Luna Foundation Guard (LFG) withdrew approximately 150m UST (see Figure 6) from Curve. This was followed by an inflow of about 85m UST by one address (0x8d…7d0a, which was created just before the inflow transaction and then only used for the Curve swap of UST vs USDC, as well as for the receipt of and subsequent transfer of the USDC to Coinbase).
Four addresses, of which one is associated with Celsius, followed suit with approximately ~105M of net UST inflows to Curve. The LFG and associated “peg defending” wallets counteracted with 189.6M UST of withdrawals and the back-and-forth continued into the morning of May 8.
Figure 6: Timeline of net UST flows to Curve, and wallets responsible for largest flows
Source: Nansen QueryWe observed that a handful of wallets launched the offensive on Curve (Figure 6). This was confirmed by aggregating net flows by wallet address over the duration of May 7 and May 8. The top 18 wallets by net flows over May 7 and May 8 accounted for 77% of total UST inflows to Curve over that period (Figure 7). On the last right-hand column of Figure 7 we flagged wallets according to two criteria: at least some activity by May 8 morning + significant aggregated deposits over May 7 - May 8.
Figure 7: Net UST flows to Curve entities on May 7 and May 8 2022, top inflows by wallet
The following four addresses accounted for the largest inflows to Curve via the 1inch DEX Aggregator:
Other wallets had significant transactions through Curve, although slightly later on. Wallet 0x99fd1378ca799ed6772fe7bcdc9b30b389518962 (N), which we have identified as a wallet associated with Hodlnaut, is an example of these “early followers”.
We then moved to cross-reference the wallets flagged above with Terra and Wormhole bridge data to refine the scope of wallets likely to have contributed to UST de-pegging.
.png)
Early Outflows From Anchor as a Foreshadow?
Figure 8: Largest Outflows from Anchor from May 7 to May 10, by flagged wallet address
Source: Nansen QueryBetween May 7 and 10, we observed that the wallet with the greatest outflow of UST from Anchor withdrew a total of over 347M UST through 8 transactions. In total, the top 20 addresses withdrew a total of 2B UST from Anchor through a total of 5,051 transactions.
Analyzing the outflows of UST from Anchor revealed that many of the Curve swap wallets that we flagged earlier started to withdraw UST tokens from Anchor as early as April 2022. Yet, the spike in withdrawal volumes from Anchor involving these wallets really started in mid-April this year.
We notably found that wallet terra1vca36gazapns38mvupa2pfjz0g39ekdgk0wnea (wallet address 0x41339d9825963515e5705df8d3b0ea98105ebb1c on Ethereum or (H) as flagged in the Curve section) made the most UST withdrawals from Anchor between April 1 and May 6 (i.e., before the de-peg event).
Figure 9: Anchor outflow statistics, by Terra wallet and associated Ethereum address
Source: Nansen QueryFurther analysis of Anchor outflows emphasized the prominence of two wallet addresses that significantly impacted the UST de-peg:
The two identified wallets initiated significant outflow volume from Anchor Protocol during the de-peg event (May 7 to May 10), totaling ~420M UST across 15 transactions. When cross-referenced with the bridging of UST from Terra to Ethereum, these two wallets were the top wallets that bridged through Wormhole.
Further Down the Trail: Bridging UST From Terra to Ethereum
The Wormhole bridge facilitates transfers of tokens across multiple chains, including Ethereum, Solana, Terra, BNB Chain, Aurora, Polygon, Avalanche, Oasis, and Fantom. In this section, we focused on UST transactions between Terra and Ethereum in order to capture any large UST inflows to Ethereum that managed to find their way to Curve and therefore led to the destabilization of the liquidity pools. Analyzing bridging transactions also highlighted any wallet keen to take their UST tokens off of Terra early, possibly to swap for other stablecoins. We focused on the days leading up to the de-peg: May 5 to May 8.
Figure 10: UST token balance on Wormhole
Source: Nansen (Wallet Profiler: Wormhole bridge)Looking at the balance of UST tokens on Wormhole, a slight increase was visible in April, followed by a significant uptick from the 5th of May and onwards, just a few days before the de-peg.
Figure 11: UST price and volume over time
Source: Nansen (Wallet Profiler: Terra USD Wormhole) By comparing price and volume of UST displayed in the chart above, we found that volume increased significantly on May 8, contemporaneously with the token’s initial loss of value. Similarly, the historical transfers from Terra to Ethereum showed significant activity around the same dates. The large spikes seen below (Figure 12) indicated that large amounts of UST were being bridged during the time of the de-peg.
Figure 12: Daily transfer to Ethereum (UST token units)
Source: Nansen QueryWhen analyzing the transactions from May 5 to May 8, we found 984 unique Terra wallet addresses active during this period. The majority of the transaction volume was concentrated in a few wallets. The transactions by the top 10 wallet addresses, for example, accounted for more than 57% of all the volume of UST transferred within that timeframe.
Additionally, we observed that the net flow distribution among the top 10 wallets was also significantly imbalanced. The difference between the total amount transferred between the top and tenth wallet amounted to more than 144M UST. Figure 13 depicts the top 10 most active wallet addresses for the observed period.
Figure 13: Top 10 wallets by transaction value from Terra to Ethereum from May 5 to May 8(UST)
Source: Nansen Query
Zooming In On Suspected Wallets (May 5 to May 8)
Based on on-chain data, we found that these wallets mainly interacted with Anchor Protocol while on Terra. They interacted with Curve and 1inch after bridging out from Terra to Ethereum.
Below, we cover some of the suspect wallets that recorded large volumes on the Wormhole Bridge shortly before the UST de-peg.
Source: Nansen (Wallet Profiler for Token: Terra USD Wormhole)This wallet was created shortly before and then deployed on May 7.
All transactions recorded were mostly UST and USDC related and ceased on May 9. The most notable transaction bridged over 85M worth of UST to Ethereum on May 7. The tokens were subsequently sent to Curve and swapped for around 84.5M USDC.
We could associate the wallet to a Terra “sister” address (terra1yl8l5dzz4jhnzzh6jxq6pdezd2z4qgmgrdt82k), which was one of the top wallets that bridged UST over to Ethereum from May 5 to May 8. As we found in our Anchor analysis, the wallet was responsible for 10 outflows from Anchor, which amounted to around 193M from May 7 to May 10.
Source: Nansen (Wallet Profiler for Token: Terra USD Wormhole)This wallet was active from late April 2022 onwards. It bridged about 138M UST tokens to Terra between April 21 and 25. Notably, the wallet bridged 175M UST out of Terra to Ethereum on the 7th of May. The wallet receiving funds from the corresponding Terra address is 0xf642ea51c645c48196d9831a5937e95b0e9b4f7f. It then sent the funds to another address on the same day (Transaction). Of the funds from this wallet, 125M were swapped for USDC on Curve in batches of 25M. Based on Nansen's data, Celsius is a close counterparty that has sent and received funds to and from this wallet.
Based on on-chain data, we could also associate the wallet to the following Terra address terra195wtjmpjxhp336mclqfsyk2plvs8mw3lhsc5nc, which was the top wallet that bridged UST out of Terra from May 5 to May 8. The wallet has also interacted with Anchor, withdrawing funds since late April.
Source: Nansen (Wallet Profiler for Token: Terra USD Wormhole)This wallet made over 62 transactions beginning in December 2021. From the beginning of April to the May 8 the wallet bridged out over 79M worth of UST to Ethereum, then swapped to USDC predominantly through 1inch aggregator through several transactions.
This wallet was associated with terra1cn2fh0k8f5ywzjl2s947xrpdnnerfnkg9qg2r7, which was also highlighted during our analysis on Anchor Protocol.
Source: Nansen (Wallet Profiler for Token: Terra USD Wormhole)Similarly, this wallet received many transactions through Wormhole, with some as early as January. On 8 May it bridged a sum of just over 20M worth of UST to Ethereum in 1 - 1.5M UST transactions at a time. This amounted to about 1.6% of the total outflows during that period.
This wallet was associated with terra1vlel4dpqldcwm7ztre3k03apcldeawpq98rah0, which has also bridged transactions to another other Ethereum address 0x6524b211ef8e4baf346f1b780b08a3811ee9f3cd in February and March. Notably, the wallet exited Anchor early compared to the other wallets, with its latest transaction being on May 1st.
Source: Nansen (Wallet Profiler for Token: Terra USD Wormhole)Based on Nansen labels, this wallet was Smart LP. The wallet bridged around 8.8M (late January) and then a further 30M worth of UST to Terra (in February). Furthermore, it bridged around the same amount out to Ethereum with a 10M transaction on April 27 and 20M on May 8. The 20M UST transaction could be traced to Curve, whereby the wallet swapped 20M of UST to USDC.
The wallet was associated with terra1vca36gazapns38mvupa2pfjz0g39ekdgk0wnea. It was also identified in our analysis on Anchor Protocol, having transacted throughout April and May. It seems to have fully exited Anchor after May 7.
Source: Nansen (Wallet Profiler for Token: Terra USD Wormhole)Based on Nansen labels, the wallet was a Token Millionaire. It was a rather new wallet that only began transacting at the end of March 2022 and had interactions with wallets related to Alpha Finance Lab. The wallet recorded transactions bridging from Terra to Ethereum on May 8 only. The transactions totaled around 30M worth of UST, which was then swapped for USDC on Curve in 3 separate transactions. The wallet was associated with terra17mh65gqelelxu9r5fyz9l56mx60zdg274fwe40.
Source: Nansen (Wallet Profiler for Token: Terra USD Wormhole)The wallet made many transactions on May 8 and May 9, bridging a total of around 60M UST to Ethereum. The funds were then swapped for USDT on Curve in separate transactions. The wallet is associated with terra1hapgv57ytaaaatvz92k46fzwxs9m2zsdr46rph.
Source: Nansen (Wallet Profiler for Token: Terra USD Wormhole)The wallet received around 10.5M UST on May 8 and the funds were swapped for USDT on Curve. Based on-chain data, the wallet is associated with terra1autyehjkpl9r4h99qa4v66h2tz8589haw9uyxm, terra1rhds9ltx9t5wxq22v9x9j26pk9tuwyykwhm9gy and terra14geatm83tykw5v3uw6klkcwwqf00tfwk72dq62. These wallets bridged 9.1M, 737K and 615K worth of UST out of Terra on May 7, amounting to around 10.5M UST which matches the transactions on the Ethereum address.
After the Storm: Selling and Arbitraging On Centralized Exchanges
All centralized exchanges’ accounts labelled by Nansen received net inflows of approximately 225m tokens including Wormhole-UST and wrapped-UST from May 1 to May 20. We refer to the aggregated Wormhole and wrapped tokens by “UST” in this section.
Notably, net UST inflows to centralized exchanges gathered momentum on May 9, 2022 and were the largest on May 10 (net 165m tokens were sent to CEXs that day). We conclude that if the net selling to CEXs likely dealt the last blow to the de-pegging process, it seemed unlikely to have initiated it. As we described earlier, UST swapping vs other stablecoins in the Curve liquidity pools predated exchange selling.
Figure 14: Total net UST flows to centralized exchanges (labeled by Nansen)
Source: Nansen QueryScanning through the top net depositors of UST to centralized exchanges, we cross-referenced some of the wallets that swapped UST early (May 7 to May 8) via the Curve pools. These wallets likely exited some of their UST positions via Curve and subsequently the exchanges.
Figure 15: Top wallets having sent UST to centralized exchanges + early Curve swappers + Wonderland (May 1 to May 10)
Source: Nansen Query
Figure 16: Top wallets having sent USDC to centralized exchanges + early Curve swappers (May 1 to May 10)
Source: Nansen QueryGiven that most of the early Curve swappers had withdrawn USDC from the pools, we reviewed the top USDC depositors on centralized exchanges from May 1 to May 20. There again, familiar wallets appeared.
We note that the wallet (A) address that initiated the first significant UST inflow on May 7 at 21:57 UTC (85m UST) and obtained 84.5m USDC in return sent the total USDC sum to Coinbase on May 8 in several transactions between midnight and 1 am UTC.
While net inflows to CEXs provided high level insight, we turned to UST flow activity among the wallets flagged earlier to understand on-chain dynamics in a more granular manner. We focused on three wallets because of their numerous and sizable transactions with CEXs (Figures 17, 18, and 19).
Figure 17: Masknft.eth significant activities - (Binance to Curve MIM-UST) and (Curve 3pool - Binance)
Source: Nansen Wallet Profiler for Token (Wormhole UST) and (Wrapped UST)Masknft.eth had a net outflow of 76.9M UST to CEXs. We observed that the wallet purchased an estimated 96.9M UST from Curve (routed from 1inch) and quickly offloaded it to Binance.
We also discovered a few transactions on May 8 (totalling about 11.9M UST) in which masknft.eth transferred UST from Binance and swapped it for MIM on Curve MIM-UST pool. While we could not confirm whether these transfers to Binance were arbitrage trades, our conjecture is that masknft.eth potentially purchased UST on Binance during the de-peg (UST hit a low of about ~0.985 on that day) and sold it for a profit on Curve the next day when the peg managed to briefly recover.
While Oapital had a net outflow of 56.9m UST into CEXs, the wallet activities were highly varied and not limited to directional flows like many of the other wallets we identified earlier.
Figure 18: Oapital significant activities
Source: Nansen Wallet Profiler for Token (Wormhole UST) and (Wrapped UST) (Estimated Values) The table above shows significant selling pressure on both Binance and FTX from Oapital alone, with the majority of the offloading activities being carried out on Binance. We could unfortunately not match the source of UST that was received from the Wormhole UST Migrator contract address.
Source: EtherscanLooking at some of Oapital’s transactions, we noticed that this wallet likely made significant gains while arbitraging, as seen in one of the transactions above. Assuming that the estimated value on the day of transfer on Etherscan accurately reflects the cost of UST for Oapital, the wallet could have netted ~$132.5k in profits from this single transaction.
Figure 19: Wonderland DAO’s UST deposits to Binance
Source: Nansen Wallet Profiler for TokenApart from the suspected addresses mentioned above, we also noticed that Wonderland DAO sent 57.4m UST to Binance between May 10 and 11, after liquidating their Abracadabra Degenbox.
“And Then There Were Seven”
Figure 20: Wallets likely to have significantly influenced UST de-peg
Conclusion
Given the magnitude of the financial and psychological consequences of the UST de-peg, many narratives of “what went down” flooded the internet. Our analysis leveraged on-chain data to demystify what happened before and during the UST de-peg. Through the examination of on-chain activities, we found that a small number of wallets and a likely even smaller number of entities behind these wallets led to imbalances in the Curve liquidity protocols that were regulating the parity between UST and other stablecoins.
Seven “initiating” wallets swapped significant amounts of UST vs other stablecoins on Curve as early as the night of May 7 (UTC). These seven wallets had withdrawn sizable amounts of UST from the Anchor protocol on May 7 and before (as early as April) and bridged UST to the Ethereum blockchain via Wormhole. Out of these seven wallets, six interacted with centralized exchanges to send more UST (supposedly for selling) or, for a subset of these, to send USDC that had been swapped from Curve’s liquidity pools.
This on-chain study refutes the narrative of one “attacker” or “hacker” working to destabilize UST. Instead, we found that a small number of players identified and arbitraged vulnerabilities - specifically in relation to the shallow liquidity of the Curve pools securing the UST’s peg to the other stablecoins. This led to the following events:
1. Withdrawing of UST funds from the Anchor protocol on Terra.
2. Bridging of these funds from Terra to Ethereum via the Wormhole infrastructure
3. Swapping of significant amounts of UST to other stablecoins in Curve’s liquidity pools
4. During the “de-pegging” process, some of these wallets likely exploited inefficiencies between various pricing sources (Curve, decentralised exchanges DEX, centralised exchanges CEX) by taking buying and selling positions in the transactions between CEX and DEX
Epilogue: on-chain data, from forensics to risk management
Given this study’s focus on on-chain data, we will refrain from commenting on the objectives of the seven wallets that triggered this chain of events. We will just add one observation to complement our on-chain investigation: when operating in crypto markets, having robust risk management framework in place, especially in volatile macro times, appears complementary to expected return analyses.
Turning to on-chain data one more time, we would like to recommend tools that could provide relevant inputs for risk management. The Nansen Smart Alert feature qualifies to the extent that it allows on-chain flow and token transfer monitoring. Smart Alerts can, for instance, receive notifications of any abnormal on-chain activity, such as irregular withdrawals from liquidity pools, which we saw from Curve pools shortly before the de-peg.
We conclude this note with a Smart Alert illustration, one triggered by any transaction of more than USD 20M in and out of Curve liquidity pools.
.png)
Disclaimer
The authors of this content and members of Nansen may be participating or invested in some of the protocols or tokens mentioned herein. The foregoing statement acts as a disclosure of potential conflicts of interest and is not a recommendation to purchase or invest in any token or participate in any protocol. Nansen does not recommend any particular course of action in relation to any token or protocol. The content herein is meant purely for educational and informational purposes only and should not be relied upon as financial, investment, legal, tax or any other professional or other advice. None of the content and information herein is presented to induce or to attempt to induce any reader or other person to buy, sell or hold any token or participate in any protocol or enter into, or offer to enter into, any agreement for or with a view to buying or selling any token or participating in any protocol. Statements made herein (including statements of opinion, if any) are wholly generic and not tailored to take into account the personal needs and unique circumstances of any reader or any other person. Readers are strongly urged to exercise caution and have regard to their own personal needs and circumstances before making any decision to buy or sell any token or participate in any protocol. Observations and views expressed herein may be changed by Nansen at any time without notice. Nansen accepts no liability whatsoever for any losses or liabilities arising from the use of or reliance on any of this content.
GoMining revolutionises Bitcoin mining by leveraging powerful computers, LBH tokens, and NFTs, democratising the industry. With a low-risk profile, a market value of $0.39, and innovative features like the Mine Box Collection, GoMining paves the way for accessible and rewarding cryptocurrency investments.
JoyStratis announces the Auroria testnet launch on February 6, with tasks and airdrops, previewing the March mainnet and featuring a user-supportive faucet tool for tSTRAX tokens.
BrianSouth Korean Financial Supervisory Service Head, Lee Bok-hyun, intends to discuss Bitcoin ETFs with SEC Chairman Gary Gensler during his US visit. Meanwhile, spurred by US approval, Asian leaders, notably in Hong Kong, explore local Bitcoin spot ETF launches.
JoyA hacker's sale of KodexGlobal access threatens major tech and crypto firms, risking user data privacy and intensifying calls for enhanced security measures.
WeiliangSouth Korea is intensifying its cryptocurrency regulation and engaging in critical dialogue with the U.S. SEC, signaling major strides in its financial and digital asset landscape.
BrianRoblox's new AI model enables real-time, cross-language communication, fostering global connections among its 70 million daily users.
BrianRipple Labs' legal battle with the SEC, highlighting the tension between cryptocurrency innovation and regulatory oversight, and its broader implications for the future of digital finance.
WeiliangPost-Terra's collapse, executives face extradition and potential life sentences, sparking major regulatory reforms in South Korea’s cryptocurrency landscape.
MiyukiVast Bank exits cryptocurrency, reflecting broader banking industry challenges amid regulatory scrutiny and strategic reassessment of digital asset integration.
AlexExplore GoMining's revolutionary approach to Bitcoin mining through NFTs, offering accessible, efficient, and flexible mining strategies for every investor.
Alex