Background
Following the emergency v2.22.0 upgrade, which restricted transactions from identified compromised and attacker-associated wallets, Phoenix Foundation (PF) has continued investigating the incident and working with affected users.
The vulnerability originated from the legacy Terra Station Desktop application developed by Terraform Labs (TFL). PF had no involvement in the development, maintenance, or distribution of the affected software.
Although PF bears no responsibility for the underlying vulnerability, we have taken the initiative to assist affected users as part of our mandate to support and protect the Terra ecosystem.
For additional background, please refer to our Preliminary Incident Report.
1. Current Status
Since the emergency upgrade, eight affected users have contacted PF and provided source-of-funds evidence to support their ownership claims.
These users collectively have approximately 1.6 million LUNA remaining in their restricted wallets, compared with approximately 10 million LUNA originally identified as being at risk and subject to the emergency response.
We have also remained in contact with TFL regarding potential assistance with historical wallet ownership verification. Unfortunately, TFL has not yet been able to provide material assistance, although communication remains ongoing.
2. Proposed Recovery Approach
For now, PF intends to continue coordinating and managing the recovery process directly, to the extent technically, financially, and legally feasible.
Our preferred approach is to:
-
Review ownership claims using independent evidence, particularly historical source-of-funds records.
-
Where sufficient evidence is available, consider reimbursing verified users for their eligible restricted LUNA balances from the PF Treasury.
-
Keep the original compromised wallets restricted to prevent the attacker from accessing the funds or creating a risk of duplicate recovery.
Based on the eight cases received so far, the approximately 1.6 million LUNA involved would be within PF’s anticipated financial capacity to cover from its existing treasury, subject to the necessary internal authorizations.
However, this represents only a portion of the roughly 10 million LUNA identified during the emergency response.
If substantially more affected users come forward, PF may not have sufficient resources to cover all claims. Additional funding or a separate governance-approved recovery mechanism could therefore become necessary.
We believe this is the most practical approach for now, as simply unfreezing compromised wallets would expose users to the risk of having their funds stolen again.
We will continue evaluating individual cases and the available options before making any reimbursement decisions.
3. Process for Affected Users
For now, we will continue following the process outlined in the original incident report.
Affected users should contact security@phoenix.money and provide their public wallet addresses, relevant transaction histories, and available source-of-funds evidence.
Since recovery phrases associated with the vulnerability may be known to attackers, a wallet signature alone is not sufficient to establish legitimate ownership.
Please never share your seed phrase, private key, or wallet password.
4. Scope and Limitations of PF Assistance
PF is undertaking these efforts voluntarily and within the scope of its existing mandate.
Neither the emergency restrictions nor PF’s involvement in investigating the incident constitutes an acknowledgment of liability or an assumption of responsibility for losses caused by the legacy Terra Station Desktop vulnerability.
Any ownership verification, recovery assistance, or reimbursement from the PF Treasury is voluntary and discretionary. No user has an automatic entitlement to compensation or payment from PF.
PF retains discretion over whether a claim can be sufficiently verified and whether assistance can be provided, taking into account available resources, technical feasibility, applicable legal requirements, and necessary internal authorizations.
Submission of evidence, participation in the verification process, or the existence of a restricted balance does not establish a contractual right to reimbursement or guarantee a successful outcome.
PF does not guarantee that all affected users can be identified, that all ownership claims can be verified, or that sufficient resources will be available to cover all eligible balances.
Any changes to on-chain restrictions or the disposition of restricted assets beyond already authorized measures remain subject to Terra Governance.
5. Next Steps
PF will continue managing the investigation and working directly with affected users to determine which cases can be reliably verified and potentially reimbursed.
For the currently known cases, we believe the PF Treasury may provide a practical path toward resolution without requiring an immediate, ecosystem-wide recovery mechanism.
Should the number or value of eligible claims exceed our financial capacity, we will assess alternative solutions and, where appropriate, present them to the Terra community and Governance.
Our priority remains helping legitimate users recover their losses where reasonably possible, without creating additional security risks or committing resources beyond PF’s capacity.
Additional On-Chain Monitoring
PF has continued monitoring on-chain activity associated with the incident, particularly for signs of further unbonding or movement of potentially compromised funds.
So far, we have not identified any additional large-scale unbonding activity.
Our latest review identified a limited number of smaller affected accounts, with approximately 1,554 LUNA currently unbonding and another 12,890 LUNA remaining staked, representing less than 15,000 LUNA combined.
The pending unbondings are scheduled to complete between October 27 and November 10, 2026.
While we will continue monitoring these accounts, the activity observed so far does not indicate any further significant wave of unbondings beyond those already identified during the initial incident response.
We encourage the community to remain vigilant. If you notice any suspicious wallet activity, unexpected unbondings, or other unusual on-chain behavior that could be related to this incident, please report it here, email security@phoenix.money, or contact a PF representative directly.