Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

$625M worth of ETH drained on Axie Infinity's Ronin Network

roninblockchain.substack.com

Post reply on HN
Print view View original

91–100 of 761 posts

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#91

Post by malfist »

mabbo wrote: post #47

In a system run by people, the transaction could be reversed, traced, and the culprits eventually brought to justice. In a system run by algorithms, designed to avoid oversight by people (governments), there is no such powers. There's no reversal. There's no checking the name on the account the transfer was to. It's just gone. I do not understand why people who have legal intentions would want to be part of the crypt…

Arguably it's the same risk as holding paper notes right? If I steal your life savings from under your mattress, there isn't necessarily anything to trace it back to me.

However, there is a physical limit, pretty damn hard to run off with half a billion worth of paper notes.

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#92

Post by UncleMeat »

RL_Quine wrote: post #33
outsb wrote: post #15

Over half a billion in assets and.. > We discovered the attack this morning after a report from a user Fuck me.

No monitoring whatsoever over $600M of funds stored in your system is crazy negligent.

It isn't like monitoring would have done anything. Once the transaction goes out it is gone. The core problem here is the massive private-key bounty being created by a ton of organizations that don't have world-class security teams.

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#93

Post by thirdwhrldPzz »

Consultant32452 wrote: post #86
joering2 wrote: post #60

Earlier quoted context omitted.

when it comes to banking, random checking accounts are hacked into very rarely. to the point that in USA the FDIC is protecting your account up to $250,000. I don't recall last time seeing news on someone's bank account being hacked and drained, if anything its mostly family fraud. also there are all sorts of checks when you try to wire or withdraw more than $10,000, not to mention wire hundreds of millions. Such tra…

Wire fraud results in billions of dollars in losses per year from checking accounts. Here's one article from 2019: https://www.cnbc.com/2019/09/11/email-wire-fraud-cost-26-bil... We talk about eth/btc as if they're just covering the function of the checking account, but it's also covering the function of the checks, wire transfers, ACH transfers, etc. So for a real comparison you'd have to count up all the related fr…

No post body was provided.

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#94

Post by tomatowurst »

dpiers wrote: post #31

I'm out of the loop and trying to understand - people lent over half a billion dollars of their 'real' fake money (ETH) to a game studio so they could transact on the studio's sidechain because gas fees are prohibitively expensive on ETH, and then the game studio got hacked and lost it all? How was this ever going to end any other way? Imagine how preposterous the idea of storing $650mm in USD in a random game studio…

Here's another preposterous offering: 20% APY "risk free" from owning crypto.

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#95

Post by unmole »

rinze wrote: post #74
dpiers wrote: post #31

I'm out of the loop and trying to understand - people lent over half a billion dollars of their 'real' fake money (ETH) to a game studio so they could transact on the studio's sidechain because gas fees are prohibitively expensive on ETH, and then the game studio got hacked and lost it all? How was this ever going to end any other way? Imagine how preposterous the idea of storing $650mm in USD in a random game studio…

> Imagine how preposterous the idea of storing $650mm in USD in a random game studio's checking account would be. But it's decentralized. (Do the same hand movement as if saying "It's got electrolytes")

> Do the same hand movement as if saying "It's got electrolytes"

I'm stealing this.

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#96

Post by phphphphp »

gen220 wrote: post #69

Question for the legal-minded folk here. Is this "theft" illegal in the criminal sense? It's exploiting an unintended hole in software, but it's technically following the smart contract faithfully, albeit against the better intentions of its author(s). Has a smart contract case like this been litigated before? It brings to mind comparable things that have happened in the financial services world, where one party insi…

this wasn’t a smart contract exploit, it was a stolen keys exploit. Very different, flat out theft rather than exploiting “code is law” (and almost certainly an inside job).

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#97

Post by jrm4 »

xiphias2 wrote: post #25

,, Originally, Sky Mavis chose the five out of nine threshold as some nodes didn’t catch up with the chain, or were stuck in syncing state’’ Sounds like a great plan for storing half billion dollars. I’m not blaming the developers, as they are incentivized to move fast and break things, I’m just sorry for all the people who trust new protocols so easily without any knowledge in safe software security practices. Perso…

"I'm not blaming the developers.."

I mean, I think it's time to put that on the table...

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#98

Post by bastardoperator »

rinze wrote: post #74
dpiers wrote: post #31

I'm out of the loop and trying to understand - people lent over half a billion dollars of their 'real' fake money (ETH) to a game studio so they could transact on the studio's sidechain because gas fees are prohibitively expensive on ETH, and then the game studio got hacked and lost it all? How was this ever going to end any other way? Imagine how preposterous the idea of storing $650mm in USD in a random game studio…

> Imagine how preposterous the idea of storing $650mm in USD in a random game studio's checking account would be. But it's decentralized. (Do the same hand movement as if saying "It's got electrolytes")

Apparently plants crave it though...

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#99

Post by mattbrewsbytes »

zaroth wrote: post #23
outsb wrote: post #15

Over half a billion in assets and.. > We discovered the attack this morning after a report from a user Fuck me.

Seriously. That was really really hard to read. So basically $600mm in a hot wallet and no one even watching it. Just wow. They didn’t even hack the smart contract, they just compromised 4 systems holding the private keys, and there was an RPC signing function giving free access to the 5th. Good god.

Sounds like if they had a checking account with their bank credentials stored in ENV variables and someone got access to that server it would be the same outcome.

The details of it being on a crypto-currency are interesting but when password/passphrase/private key security is poor it doesn't really matter the medium holding the money.

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#100

Post by Loughla »

oblib wrote: post #82

I have not dug into the details of how this stuff works because every time I've looked for them what I found looked like bullshit. They all imply this stuff is so secure no one knows who's "money" it really is, and that's supposed to be a feature. I'm still not regretting not buying into this stuff.

>I'm still not regretting not buying into this stuff.

I mean, I am 100% regretting spending 15 bitcoin in college on. Um. stuff instead of just sitting on it as a speculative tool.

Other than that, I have had family approach me asking about crypto in general and BTC specifically in the last year.

I always tell them - it's like gambling, except on top of maybe losing your money, somebody is going to try to steal it from you at some point as well, and there's no cops you can call.

Post reply on HN