UST/LUNA Collapse: When “Stable” Isn’t

Archive note: this is a backdated post, written years later while rebuilding this site. It’s dated to the moment it covers, but the hindsight is real.

In the second week of May, TerraUSD (UST) — the third-largest stablecoin, a token whose entire job was to be worth one dollar — fell to ninety cents, then sixty, then ten. Its sister token LUNA went from $80-something to fractions of a cent, printing trillions of new tokens on the way down. Roughly $40 billion evaporated in days. Exchanges delisted, the chain was halted, and “do you know anyone who had savings in Anchor?” became a genuinely painful question — including in PH crypto circles, where Anchor’s yields had been passed around group chats since the FOMO days.

This one deserves an engineering post-mortem, because the failure wasn’t a hack or a rug pull. The system worked exactly as designed. The design was the bug.

The mechanism, plainly

Stablecoins hold a $1 peg in different ways. Collateralized ones (USDC, USDT — with varying degrees of audit comfort) claim a real dollar-ish asset behind each token. UST was algorithmic: backed not by dollars but by a mint-and-burn arbitrage with LUNA:

Always redeemable: burn 1 UST → mint $1 worth of LUNA (and vice versa).
UST below peg? Arbitrageurs buy cheap UST, burn it for $1 of LUNA, pocket the difference — buying pressure restores the peg.
Demand for UST came overwhelmingly from Anchor Protocol, which paid ~20% yield on UST deposits. (Twenty. Percent. On a “savings account.” Hold that thought.)

The circularity is visible from orbit: UST is backed by LUNA’s value, and LUNA’s value derives from demand for UST. It’s a system that is rock-solid as long as nobody needs it to be — and self-devouring the moment confidence breaks. When large UST withdrawals cracked the peg, redemptions minted LUNA at scale, hyperinflating its supply, which destroyed the very asset backing the peg, which accelerated the run. A death spiral isn’t an edge case of this design; it’s the design’s terminal state, awaiting input.

The engineering lessons

Reflexive systems fail all at once. Anything where the safety mechanism depends on the value of a thing the safety mechanism is propping up has no graceful degradation mode — only “fine” and “zero.” In our world: retry storms that amplify outages, autoscaling that bankrupts you, circuit breakers wired backward. Stability that requires confidence is instability, deferred.
Yield is a price, not a gift. 20% on a dollar peg meant someone was paying enormously for UST demand to exist. When the subsidy is the product, the product ends with the subsidy. The grim rhyme with play-to-earn economics is left as an exercise.
“It hasn’t broken” is not “it can’t break.” UST survived earlier wobbles, which was cited as proof of resilience. Surviving small stress proves nothing about reflexive collapse thresholds — like a dam that’s “proven” safe by every flood except the one that takes it.
Words in interfaces carry duty. Millions of normal people read “stablecoin” and “anchor savings” and heard bank account. The gap between what the mechanism was and what the language implied is where the life savings went. Naming things honestly is an engineering responsibility — in DeFi, in our apps, everywhere.

Where this leaves things

Regulators worldwide just got their exhibit A, and stablecoin legislation is now a when. The contagion is still spreading through funds and lenders as I write. And the broader crypto winter this has accelerated lands hardest on the experiment closest to home — the play-to-earn economy that PH players depend on, already deep in trouble after its own catastrophic spring. That post-mortem is next month’s post; it deserves its own.

For now, the takeaway fits on an index card: if the stability comes from an algorithm, the algorithm is the counterparty. Read it before trusting it with rent money.