$625M worth of ETH drained on Axie Infinity's Ronin Network • Hacker News Board

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#81

Post by rottencupcakes » Tue, Mar 29, 2022, 4:48 PM UTC

tl;dr: in what is supposed to be a decentralized system, 9 validator machines had the power to approve or deny transactions. 4 of these are owned by the same person and shared credentials, and 1 of these had its credentials stored on the aforementioned 4 because user load was bad once, so they just decided to use the other machine’s resources.

In other words, hacking one validator gave a user full access to the system, because that gave them access to 5/9 validators which is a majority.

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#82

Post by oblib » Tue, Mar 29, 2022, 4:48 PM UTC

I have not dug into the details of how this stuff works because every time I've looked for them what I found looked like bullshit. They all imply this stuff is so secure no one knows who's "money" it really is, and that's supposed to be a feature.

I'm still not regretting not buying into this stuff.

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#83

Post by arthurcolle » Tue, Mar 29, 2022, 4:48 PM UTC

ericjang wrote: post #63

Supposing the hacker gets away with stealing such large quantities of stolen ETH without getting caught and their ETH is now sitting in a brand new wallet that everyone knows about. Is the next move to convert it into a privacy-preserving coin like Monero, then back to "clean" ETH? source: https://ethereum.stackexchange.com/questions/2699/is-there-a...

tornado.cash

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#84

Post by granzymes » Tue, Mar 29, 2022, 4:48 PM UTC

radicaldreamer wrote: post #65

dpiers wrote: post #31

I'm out of the loop and trying to understand - people lent over half a billion dollars of their 'real' fake money (ETH) to a game studio so they could transact on the studio's sidechain because gas fees are prohibitively expensive on ETH, and then the game studio got hacked and lost it all? How was this ever going to end any other way? Imagine how preposterous the idea of storing $650mm in USD in a random game studio…

The chance of $650 million being drained from a game studio’s bank account is significantly less than it being drained from their ETH wallets, at least as of now.

And if it was drained from a bank account, you have recourses to get it back.

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#85

Post by px43 » Tue, Mar 29, 2022, 4:48 PM UTC

adtac wrote: post #22

This probably sounds like an insanely dumb idea to crypto people, but is it absolutely infeasible to reverse transactions when there's consensus that it's a hack? The TX fees need not be reversed (consider it to be a small price to pay for being hacked). A little bit of centralisation could make the whole network safer. Who is that centralised authority to decide what's a hack, I hear you ask. I don't know, but the a…

If you think that's actually a good idea, then do it. Make a fork where people can have their money back, and see who follows you. There's no need to ask permission. The entire crypto-ecosystem thrives on crypto-darwinism. Projects experimenting with various forms of governance to see what survives, and what sticks.

Axie's Ronin network was a centralized side-chain experiment. Unfortunately what got exploited was the bridge back to the more decentralized ETH Mainnet. They failed to have proper fail safes on the bridge, and they got looted. Maybe their project survives this, maybe it doesn't.

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#86

Post by Consultant32452 » Tue, Mar 29, 2022, 4:49 PM UTC

joering2 wrote: post #60

dpiers wrote: post #31

I'm out of the loop and trying to understand - people lent over half a billion dollars of their 'real' fake money (ETH) to a game studio so they could transact on the studio's sidechain because gas fees are prohibitively expensive on ETH, and then the game studio got hacked and lost it all? How was this ever going to end any other way? Imagine how preposterous the idea of storing $650mm in USD in a random game studio…

when it comes to banking, random checking accounts are hacked into very rarely. to the point that in USA the FDIC is protecting your account up to $250,000. I don't recall last time seeing news on someone's bank account being hacked and drained, if anything its mostly family fraud. also there are all sorts of checks when you try to wire or withdraw more than $10,000, not to mention wire hundreds of millions. Such tra…

Wire fraud results in billions of dollars in losses per year from checking accounts. Here's one article from 2019:

https://www.cnbc.com/2019/09/11/email-wire-fraud-cost-26-bil...

We talk about eth/btc as if they're just covering the function of the checking account, but it's also covering the function of the checks, wire transfers, ACH transfers, etc. So for a real comparison you'd have to count up all the related fraud from legacy checking accounts and their various mechanisms to move money between them.

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#87

Post by CartyBoston » Tue, Mar 29, 2022, 4:49 PM UTC

gitfan86 wrote: post #68

dpiers wrote: post #31

I'm out of the loop and trying to understand - people lent over half a billion dollars of their 'real' fake money (ETH) to a game studio so they could transact on the studio's sidechain because gas fees are prohibitively expensive on ETH, and then the game studio got hacked and lost it all? How was this ever going to end any other way? Imagine how preposterous the idea of storing $650mm in USD in a random game studio…

At least with a checking account you may be able to have the transfer reversed. The idea of buying game credits and trading them in game makes sense, but you would want the game publisher to have root on the ledger so that if there was a hack they could reverse it.

that sounds like a bank

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#88

Post by paxys » Tue, Mar 29, 2022, 4:49 PM UTC

dpiers wrote: post #31

I'm out of the loop and trying to understand - people lent over half a billion dollars of their 'real' fake money (ETH) to a game studio so they could transact on the studio's sidechain because gas fees are prohibitively expensive on ETH, and then the game studio got hacked and lost it all? How was this ever going to end any other way? Imagine how preposterous the idea of storing $650mm in USD in a random game studio…

Giving $650mm in USD to a random company is still infinitely safer than doing so with crypto. If a regulated bank claims they got hacked and lost that amount, there are a slew of federal and state laws and agencies in place to investigate it. With crypto, it could very well be in the wallet of the CEO or IT guy and no one would know.

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#89

Post by xur17 » Tue, Mar 29, 2022, 4:49 PM UTC

horsawlarway wrote: post #42

arcticbull wrote: post #32

Earlier quoted context omitted.

I mean we have an answer to that, it's called the law, and its worked since 1750BC. [edit] This guy, Hammurabi - king of the First Babylonian Dynasty - faced a similar quandary, so there's some prior art. Disputes under the law are resolved in court.

No one in crypto typically wants to acknowledge this, but this is the clear and robust answer. Your keys your coins is obviously a situation rife for unreconcilable fraud, and is not a functional solution for anyone who might - ya know, want to spend these things as a currency.

I disagree. It's definitely a trade-off, and there are downsides to it (this security breach being a good example), but there are also advantages.

With normal ACH and credit card transactions, the payment never really settles, and can be reverted due to fraud for months. That means I have to slurp up lots of data (privacy?) about my users in order to increase my confidence that they won't try to scam me. And even with that, I end up losing significant amounts of money due to payments with stolen card numbers, etc.

With crypto, I know that any payment I receive is final, and I don't have to build privacy violating systems to avoid losing $$$.

Not saying this is necessarily "better", but there are advantages to it. As a user, I'd be happy to pay with crypto if the merchant passed some of the savings on to me.

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#90

Post by the_svd_doctor » Tue, Mar 29, 2022, 4:50 PM UTC

joering2 wrote: post #60

dpiers wrote: post #31

I'm out of the loop and trying to understand - people lent over half a billion dollars of their 'real' fake money (ETH) to a game studio so they could transact on the studio's sidechain because gas fees are prohibitively expensive on ETH, and then the game studio got hacked and lost it all? How was this ever going to end any other way? Imagine how preposterous the idea of storing $650mm in USD in a random game studio…

when it comes to banking, random checking accounts are hacked into very rarely. to the point that in USA the FDIC is protecting your account up to $250,000. I don't recall last time seeing news on someone's bank account being hacked and drained, if anything its mostly family fraud. also there are all sorts of checks when you try to wire or withdraw more than $10,000, not to mention wire hundreds of millions. Such tra…

FDIC protects against bank failures (like the bank goes bankrupts and looses all the deposited money). It has nothing to do with unauthorized transactions as far as I know.