WAGMI with Onchain Wizard: How an attacker destroyed a stablecoin to make $1 billion
Primer: Join Luke Martin in this episode of the WAGMI podcast, where he interviewed Onchain Wizard who had deconstructed the depegging event of UST, but from the point of view of the attacker. How much did the attacker make, and who could be the possible identity of the attacker? All these and more from the podcast summary below.
Background of Onchain Wizard
Had been in the traditional stock investment management for a decade
Got into crypto because he had friends making money during BSC season
Learnt that crypto is a murky place and he went on to learn how to watch wallets and find event-driven trades
Started a Twitter account as Onchain Wizard to try teaching people how to invest intelligently on smaller cap coins
Based on his experience, 90% of people just buy on Twitter calls
On his Twitter account and Substack, he will do deep dives on tokens and teach people to build the tools and skills to not get rekt
Some things to know before beginning
Caveat
All the things mentioned are facts that can be verified on-chain
The only thing that is speculation is whether the attacker shorted at all and what they shorted
What is UST/Luna?
UST is an algorithmic stablecoin that is not backed by any collateral and is pegged to 1 USD
It has a burn/mint mechanism with Luna as a mechanism to restore the peg
When the price of UST goes above peg, the supply is too small and the demand too high
Luna is burnt to mint more UST, supply goes up and the price of UST goes down
Luna pool gets smaller and the price of Luna goes up
When the price of UST goes below peg, the supply is too large and the demand too low
Terra is burnt to mint more Luna, supply goes down and the price of UST goes up
Luna pool gets bigger and the price of Luna goes down
What is Anchor?
Anchor is a DeFi lending/borrowing protocol that gives a high APY of 19.5% to depositors
UST is deposited into the protocol to earn the return
Timeline of attack
March 22nd
Lunar Foundation Guard (LFG) starts buying Bitcoin (BTC) to add more backing to UST
The first buy-in was on March 22nd
March 26th
Between March 27th to April 11th, they had built a billion-dollar position on BTC of up to 42,000 BTC
This is leg #1 that started the attack
April 1st
Announced the 4pool (UST-FRAX-USDC-USDT) Frax announcement for UST
This is to change the main trading pool for UST on Curve
This is leg #2 that helps to execute the attack in a capital-efficient way because it will take a lot less money to clear the Curve pool
The 3pool (USDC, USDT and DAI) has a lot of liquidity and for the attacker to depeg UST, they will have to drain the pool by taking $800 million and running it through there
May 8th
On May 8th, they started pulling liquidity
10 mins after the first transaction of them pulling liquidity ($150 million), the attack started
The attacker used $350 million UST to drain the Curve 3pool
They pulled another $100 million more of liquidity within like an hour
This was done very quickly so that the exits are closed, but looking at the chart of UST, it did not depeg much. UST was down to about 97 cents
What happened was that the door to get out of UST is closed because no one can go to Curve and swap it to DAI, USDC or USDT since all the liquidity had been drained off
Not sure if the attacker had shorted BTC or Luna. This is all speculation
May 9th
LFG start selling Bitcoin to defend the peg and this can be seen from the BTC chart coming into May 9th
The attacker used the remaining UST to start offloading that onto Binance and that caused panic and the subsequent bank run
At that point, Onchain Wizard saw some tweets saying that there is an unlimited seller of UST on Binance
But people didn’t put this information together to piece together the story
Bank run started
People didn’t know it was a coordinated attack
The attacker bought their UST at a dollar and if they are depegging it, wouldn’t they make a loss?
The only reason to do that is that they had a bigger position to profit from this whole attack
UST went down to around 60 cents
Anchor, which holds 70% of all UST, had withdrawals amounting to about $3 to $4 billion dollars a day
LFG sold all their Bitcoin reserves at a loss trying to defend the peg of UST
Didn’t matter because people keep thinking that the peg is going to just get worse, so they sell more, causing the price to fall further and causing more panic
The other side of the mechanic is that Luna has to be created to restore the peg
The supply goes up and the price of Luna started tanking from $50-$60 to $20 to $1 in a week
They could have stopped trading but it happened way too fast and it spiralled out of control
From peak to trough, this was a bigger blow-up than Enron
How much did the attacker make?
Not sure what instrument the attacker shorted: Bitcoin or Luna or both
Assuming that the attacker borrowed BTC based on Do Kwon’s buying of 100,000 BTC at an average price of $42k, that is a position size of $4.2 billion
The trading price (at the time of the interview) of BTC was around $28k, so it’s about $1.5 billion dollars profit
There is some ‘cost’ to the attack:
Some losses on the selling of UST on Binance
Some losses on Curve for the liquidity draining
Conservatively, a billion dollars were made here in like 30 days
Who is the attacker?
Speculation on Reddit and 4chan threads that it was Citadel and Gemini who did this was refuted
The weirdest one was a tweet by Justin Sun, saying that he was buying a lot of UST and he had a secret plan
Within 24 hours, UST got depegged and Luna tanked
Not sure why anyone who is crypto-native will want to do this because it’s a net negative for everyone in the space
Delayed mass adoption because of this
Regulations might be coming in
Onchain wizard speculated that it will be
Someone with the size to pull this kind of attack
Someone not crypto native or does not have a crypto native business
The attacker must have linked up with some people who understood the Luna mechanism and Anchor protocol
Together they could have sized up how big Anchor was in comparison to the liquidity of exiting UST
Whoever did the loan for BTC most certainly knows who the attacker is
This means that Do Kwon most likely knows who they are
How to prevent this from happening again?
Some backing of the algorithmic stablecoin with collateral will help, though it’s not clear how many % of the backing is required
Have a really really deep Curve liquidity pool for the stable and keep it alive
All information presented above is for educational purposes only and should not be taken as investment advice. Summaries are prepared by The Reading Ape. While reasonable efforts are made to provide accurate content, any errors in interpreting and summarizing the source material are ours alone. We disclaim any liability associated with the use of our content.