Terra/Luna's Death Spiral: $40B Destroyed by Mechanism Design, Not Code Bugs

TL;DR

• Terra's UST stablecoin and Luna governance token collapsed in May 2022. Roughly $40B of value evaporated in under a week. Zero code bugs were exploited.
• The mechanism: UST was redeemable for $1 worth of Luna at any time. When UST de-pegged below $1, redemption pressure forced Luna minting, which crashed Luna's price, which made UST less redeemable, which intensified the de-peg.
• The system worked exactly as designed. The design was reflexively unstable under the specific conditions that arose.
• Audit firms had reviewed Terra's code. They found no exploits. The collapse came from a system-level property (positive feedback under stress) that code review does not detect.
• Lesson for founders: a mechanism review is a separate discipline from a code audit. Most teams skip the mechanism review entirely, then ship designs that work fine in spreadsheets and fail in production.

Why this matters

Smart contract audits catch code bugs. They don't catch mechanism failures. Terra/Luna is the largest demonstration of this distinction in DeFi history. Forty billion dollars of value vanished from a system whose code was operating exactly as the team and auditors intended.

If you're a Web3 founder designing tokenomics, monetary policy, governance incentives, or any system where multiple agents respond to each other's actions, this article is the cautionary tale. Most founders think the audit catches everything. It doesn't. There are entire bug classes that live above the code level.

The Terra/Luna collapse killed a $40B project, took down two hedge funds (Three Arrows Capital, Voyager), contributed to the bankruptcy of multiple lenders (Celsius, BlockFi), and erased an estimated $1T from the broader crypto market in cascading liquidations. None of this came from a smart contract bug.

How UST and Luna were supposed to work

Terra's design was elegant on paper. Two tokens:

• UST: an algorithmic stablecoin pegged to $1. No collateral backing in the traditional sense. Anyone could mint UST or redeem UST through the protocol.
• Luna: the governance and staking token. Validators staked Luna to secure the chain.

The arbitrage mechanism kept UST near $1:

• If UST < $1: a user could buy UST cheap and redeem it through the protocol for $1 of Luna. The protocol burned the UST and minted equivalent Luna. The user sold the Luna at market for a profit.
• If UST > $1: a user could buy Luna at market, burn it through the protocol to mint UST at $1, sell UST at market for a profit.

Both directions of arbitrage minted/burned Luna proportional to UST supply changes. In equilibrium, supply on both sides moved smoothly.

The mechanism worked for two years. UST grew from $0 to $18B in market cap. Luna grew from a few hundred million to nearly $40B. The system handled normal-volume redemptions cleanly.

The reflexive feedback loop

The mechanism's failure mode emerged when redemption pressure exceeded a critical threshold.

Walk through the May 2022 collapse step by step:

Day 1: small de-peg

Large UST holders withdraw from Anchor (Terra's lending protocol that paid 20% APY on UST). UST briefly trades at $0.99 due to selling pressure on Curve.

Some holders panic and redeem UST for Luna. The protocol mints Luna to absorb the redemption. Newly-minted Luna gets sold for stablecoins, depressing Luna's price slightly.

This is normal market behavior. The mechanism handles it.

Day 2: pressure increases

More holders, seeing the small de-peg, redeem. More Luna is minted. Luna price drops further. Now Luna's market cap is approaching UST's market cap; the protocol's "reserve asset" (Luna) is no longer dominantly larger than its liability (UST).

The arbitrage is still mechanically valid: if UST is at $0.95, you can still redeem 1 UST for $1 of Luna. But now "$1 of Luna" requires more Luna tokens than yesterday because Luna's price has fallen. So each UST redemption mints proportionally more Luna.

Day 3: reflexive cascade

Holders see Luna's price falling rapidly. They reason: "if Luna keeps falling, the redemption mechanism's collateral evaporates. UST will lose its peg permanently. I should redeem now while the mechanism still works."

This is the start of the reflexive cascade. Holders redeem because they fear the mechanism failing. The redemption itself accelerates the mechanism's failure.

In a single day, billions of dollars of UST are redeemed. The protocol mints billions of Luna tokens. Luna's supply roughly triples. Luna's price drops 60% on heavy selling pressure.

Day 4-5: terminal state

Luna's price has fallen 95%+ from peak. The protocol can still mint Luna to absorb UST redemptions, but the mint rate is now in the hundreds of millions of tokens per day. Luna's hyperinflation makes it effectively worthless. UST's redemption value approaches zero.

By day 5, both tokens are below 1% of peak value. Total destruction: roughly $40B in market cap evaporated. Some holders (those who redeemed early) recovered most of their UST value. Most holders (those who held through the cascade) lost nearly everything.

What broke and why audits didn't catch it

The system worked exactly as designed. The design's failure mode was positive feedback under stress: each redemption made the next redemption worse.

Smart contract audits review code. They confirm:

• The mint function correctly burns UST and mints Luna at the protocol's stated exchange rate.
• The redemption math doesn't have arithmetic bugs.
• Access control prevents unauthorized minting.
• The price oracle is reliable (in Terra's case, it used the chain's own validator-voting mechanism).

All of these were correct. The bug was in the system's macro-dynamics, not in any individual function. Specifically:

1. No circuit breaker. The protocol had no mechanism to slow or pause redemptions when stress increased. A bank run had no friction.

2. Reserve asset and liability tied to each other. Luna's value was reflexively coupled to UST's stability. When UST de-pegged, Luna's value derived in part from the perceived chance of UST's continued operation. As that chance fell, Luna fell. As Luna fell, UST's redemption became less valuable. Tight reflexive coupling.

3. No external collateral. The Bitcoin reserve fund (~$3B at peak) was insufficient relative to UST's $18B market cap. When the reserve sold, it dropped Bitcoin's price slightly without buying enough time for the mechanism to recover.

4. No anti-reflexive design. Other algorithmic stablecoins (DAI, Liquity) avoid this pattern by collateralizing with assets uncorrelated to the stablecoin's own token.

A code audit checks for code bugs. It doesn't ask "what happens when half the supply tries to redeem in a week?". That's a different discipline: mechanism review.

What a mechanism review would look like

A mechanism review is to a code audit what a stress test is to a unit test. Different methodology, different deliverable, different skill set required.

A mechanism reviewer asks:

1. What are the possible market states?

Enumerate. For Terra: peg holds, peg breaks slightly, peg breaks moderately, peg breaks severely. Each state has different participant incentives.

2. What are participant strategies in each state?

For Terra in "peg breaks slightly": rational holders redeem to lock in $1. The protocol absorbs the redemption. New equilibrium found.

In "peg breaks moderately": rational holders redeem AND short Luna (because Luna inflation is now visible). The combined pressure accelerates the de-peg.

In "peg breaks severely": every rational holder redeems immediately. The mechanism's collateral evaporates. Death spiral.

3. Are there positive feedback loops between states?

For Terra: yes. State 2 produces actions that move the system toward state 3. State 3 produces actions that lock the system in state 4. Once in state 3, recovery is mathematically possible but operationally extremely difficult.

4. What's the protocol's response to each state?

For Terra: nothing. The mint-burn mechanism ran identically across all states. The Bitcoin reserve was deployed but not at sufficient scale.

A protocol with adequate mechanism design would have:

• Circuit breakers that pause or rate-limit redemptions during stress.
• Counter-stake collateral uncorrelated with Luna.
• Adaptive fees on redemption that increase under stress to slow withdrawals.

5. What's the failure mode if the response is insufficient?

For Terra: total collapse. The mechanism had no equilibrium below ~$0.95 UST. Once breached, no force returned the system to peg.

This is the question audits don't ask. It's also the most important question.

Compare to other algorithmic stablecoin failures

Terra is not the first algorithmic stablecoin to collapse this way:

• Iron Finance (June 2021): similar mechanism, similar failure. Lost roughly $2B. Mark Cuban famously took a public loss. The protocol team had warning signs and didn't act.
• Basis Cash (early 2021): shorter run, smaller scale, same mechanism failure. Quietly faded.
• Empty Set Dollar (2020-2021): never reached significant scale before failing.

The pattern: every uncollateralized algorithmic stablecoin has eventually failed via the same reflexive mechanism. There has not been a counterexample. Either the mechanism is fundamentally unsound, or the conditions for soundness are so narrow that the parameter space hasn't been found.

Tellingly, Terra's team had observed the earlier failures. They had publicly distinguished Terra's design from Iron Finance, claiming the addition of validator staking and the Bitcoin reserve made Terra "different". The collapse showed they were not different in the way that mattered.

Related questions

What about MakerDAO's DAI? It's also stablecoin and survived. DAI is overcollateralized. Users lock 150% of DAI's value as collateral (in ETH or other assets). If collateral falls below threshold, it's liquidated. The collateral is uncorrelated with the stablecoin's value, breaking the reflexive feedback loop.

What about USDC? It survived too. USDC is fully reserve-backed. One-to-one fiat collateral held in regulated banks. The mechanism is centralized, but the centralized collateral provides anti-reflexive stability. USDC's brief 2023 de-peg (during the Silicon Valley Bank failure) recovered as soon as Circle's reserves were confirmed accessible.

Was Anchor's 20% APY the real cause? Anchor was the proximate cause (large UST supply was held there for yield). But Anchor only set the conditions; the death spiral mechanism was Terra's. A protocol with bullet-proof mechanism design would have survived large Anchor outflows.

Could a circuit breaker have saved Terra? Probably yes. A redemption rate-limiter (e.g., max 5% of UST supply redeemable per day) would have prevented the cascade by giving the system time to recover. The trade-off: peg-defense via friction. Many algorithmic stablecoins now include similar mechanisms.

Is the founder of Terra criminally liable? Do Kwon (Terra's founder) was indicted in South Korea and the United States for fraud and other charges. The legal question is whether he and the team misrepresented the mechanism's stability. The mechanism design itself is not, by itself, a crime; the misrepresentation is.

What if my protocol isn't a stablecoin? The lesson generalizes. Any system where agents respond to other agents' actions has potential reflexive feedback. Lending protocols (cascade liquidations), DEXes (death spirals during low liquidity), governance systems (whale concentration). Mechanism review applies to all of them.

Where to see this in Academy

eMBA Module 1 Lesson 3 (Mechanism Design and Failure Modes) walks through Terra's collapse step by step, with the specific equations governing UST/Luna interaction. The lesson then exercises mechanism-review methodology against student-submitted protocol designs: enumerate states, identify positive feedback, propose circuit breakers.

Module 1 Lesson 11 (From Idea to Spec) requires students to write a one-page mechanism review for their own protocol design before any code is written. The exercise is uncomfortable, which is the point. Most founders discover their first mechanism design has a Terra-like failure mode buried in it.

Module 3 (Security from Day One) covers the related discipline of stress-testing operational responses to mechanism failures: who pauses the protocol when redemption rates spike? What's the on-chain governance latency? Are circuit breakers governance-controlled (slow) or admin-controlled (fast, but creates centralization risk)? Trade-offs that have to be made before launch, not during a panic.