Mirror Protocol was exploited starting October 8, 2021, via inadequate access control on collateral unlock functions, allowing attackers to withdraw ~$90M over 7 months before discovery in May 2022. A follow-up $2M exploit in May 2022 exploited oracle misalignment during the LUNC-LUNA2 transition.