Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

$625M worth of ETH drained on Axie Infinity's Ronin Network

roninblockchain.substack.com

Post reply on HN
Print view View original

21–30 of 761 posts

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#21

Post by bruce511 »

CydeWeys wrote: post #6
toyg wrote: post #3

> The attacker used hacked private keys Why do people write "hacked" instead of "stolen"? To make it look like robbing them is harder than it actually is?

What meaningful distinction is drawn by using one of these words over the other? "Hacked" typically implies it happened over the net, whereas "stolen" typically implies it physically happened in person. The former is more appropriate here, no?

I'm not sure I agree. I mean secrets can be stolen. Apparently pirating music or movies is theft and so on.

We've often seen the naritive of Big company stealing ideas etc from smaller companies.

So stealing can extend beyond simple physical property, and could acceptably encompass IP as well.

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#22

Post by adtac »

This probably sounds like an insanely dumb idea to crypto people, but is it absolutely infeasible to reverse transactions when there's consensus that it's a hack? The TX fees need not be reversed (consider it to be a small price to pay for being hacked).

A little bit of centralisation could make the whole network safer. Who is that centralised authority to decide what's a hack, I hear you ask. I don't know, but the authority could be elected and impeachable to make it more democratic.

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#23

Post by zaroth »

outsb wrote: post #15

Over half a billion in assets and.. > We discovered the attack this morning after a report from a user Fuck me.

Seriously. That was really really hard to read.

So basically $600mm in a hot wallet and no one even watching it. Just wow.

They didn’t even hack the smart contract, they just compromised 4 systems holding the private keys, and there was an RPC signing function giving free access to the 5th. Good god.

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#24

Post by cesaref »

toyg wrote: post #3

> The attacker used hacked private keys Why do people write "hacked" instead of "stolen"? To make it look like robbing them is harder than it actually is?

Stolen has a very specific meaning, it involves taking something from someone else, denying them the ability to use it. If the person still has the thing, you've not stolen it.

I think 'copied' is the right word here. They hacked the system, and copied the keys.

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#25

Post by xiphias2 »

,, Originally, Sky Mavis chose the five out of nine threshold as some nodes didn’t catch up with the chain, or were stuck in syncing state’’

Sounds like a great plan for storing half billion dollars. I’m not blaming the developers, as they are incentivized to move fast and break things, I’m just sorry for all the people who trust new protocols so easily without any knowledge in safe software security practices.

Personally I’m a Bitcoin only person, because I respect the amount of work that the software authors do to minimize the attack surface, but at the end the free market will select the winners and losers.

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#26

Post by RL_Quine »

adtac wrote: post #22

This probably sounds like an insanely dumb idea to crypto people, but is it absolutely infeasible to reverse transactions when there's consensus that it's a hack? The TX fees need not be reversed (consider it to be a small price to pay for being hacked). A little bit of centralisation could make the whole network safer. Who is that centralised authority to decide what's a hack, I hear you ask. I don't know, but the a…

What is your threshold? Who decided what is "not legitimate" activity? Clearly in this case the money was spent using the keys that were allocated to be able to control the money, what process overrides that?

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#28

Post by ganzuul »

MichaelGlass wrote: post #16
toyg wrote: post #3

> The attacker used hacked private keys Why do people write "hacked" instead of "stolen"? To make it look like robbing them is harder than it actually is?

If you have a legal system, then breaking my lock is unlawful intrusion, and if you take something from behind my locked door, it's theft. Without a legal system, e.g. crypto, if you solve my puzzle, then you deserve the reward. It's just math!

No post body was provided.

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#30

Post by shakezula »

adtac wrote: post #22

This probably sounds like an insanely dumb idea to crypto people, but is it absolutely infeasible to reverse transactions when there's consensus that it's a hack? The TX fees need not be reversed (consider it to be a small price to pay for being hacked). A little bit of centralisation could make the whole network safer. Who is that centralised authority to decide what's a hack, I hear you ask. I don't know, but the a…

You’re describing a hard fork - exactly what created Ethereum and Ethereum Classic after the DAO hack. Even now it’s still considered a controversial move.
Post reply on HN