Mirror Protocol was exploited from October 8, 2021 through May 17, 2022 (discovered) via duplicate ID vulnerability in collateral unlock logic, allowing excessive unlocks without proportional validation. Over seven months, attackers siphoned $89.7M before detection due to limited Terra monitoring.