Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

$625M worth of ETH drained on Axie Infinity's Ronin Network

roninblockchain.substack.com

Post reply on HN
Print view View original

121–130 of 761 posts

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#121

Post by ozten »

"We are working with law enforcement officials..."

If the promise of ETH contracts is that code is law and to eliminate needing trust, then how and why would law enforcement get involved?

Did the attackers break down the door and steal the money? Or did the provide a widget that met the contract and which just happened to have the unfortunate side-effect of siphoning off tokens, a bug which will be fixed in the next revision of the contract...

I 100% agree this behavior is immoral, but as web3 coders become essentially lawyers, is it illegal? The further we go from fiat currency, are we burdening a specific countries tax-funded investigation and enforcement?

Fascinating stuff!

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#122

Post by misiti3780 »

woodruffw wrote: post #45
adtac wrote: post #22

This probably sounds like an insanely dumb idea to crypto people, but is it absolutely infeasible to reverse transactions when there's consensus that it's a hack? The TX fees need not be reversed (consider it to be a small price to pay for being hacked). A little bit of centralisation could make the whole network safer. Who is that centralised authority to decide what's a hack, I hear you ask. I don't know, but the a…

I'm not a cryptocurrency person, but my understanding is that that's happened before: ETH effectively rolled back the DAO hack[1] in 2016. The end result was the "Ethereum Classic" split, which continues to this day. There are all kinds of financial ramifications to this kind of split, nearly all of which (to the best of my knowledge) remain unsolved. The problem that you've correctly observed gets to the very root o…

they hard-forked the DOA, the old fork is still traded as ETH Classic no?

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#123

Post by [deleted] »

joering2 wrote: post #60
dpiers wrote: post #31

I'm out of the loop and trying to understand - people lent over half a billion dollars of their 'real' fake money (ETH) to a game studio so they could transact on the studio's sidechain because gas fees are prohibitively expensive on ETH, and then the game studio got hacked and lost it all? How was this ever going to end any other way? Imagine how preposterous the idea of storing $650mm in USD in a random game studio…

when it comes to banking, random checking accounts are hacked into very rarely. to the point that in USA the FDIC is protecting your account up to $250,000. I don't recall last time seeing news on someone's bank account being hacked and drained, if anything its mostly family fraud. also there are all sorts of checks when you try to wire or withdraw more than $10,000, not to mention wire hundreds of millions. Such tra…

[deleted]

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#124

Post by chockchocschoir »

gen220 wrote: post #69

Question for the legal-minded folk here. Is this "theft" illegal in the criminal sense? It's exploiting an unintended hole in software, but it's technically following the smart contract faithfully, albeit against the better intentions of its author(s). Has a smart contract case like this been litigated before? It brings to mind comparable things that have happened in the financial services world, where one party insi…

One could make the same argument of any computer system where the security wasn't as tight as one could hope.

"But judge, they never patched their $software to the latest version, so technically the software allowed me to dump the contents of the IMAP server"

Intents matter. If you commit a crime ("Stealing" is a crime), it doesn't matter if you did so via software, contracts, smart contracts, blockchain or else. A crime is a crime is a crime.

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#125

Post by lottin »

mabbo wrote: post #47

In a system run by people, the transaction could be reversed, traced, and the culprits eventually brought to justice. In a system run by algorithms, designed to avoid oversight by people (governments), there is no such powers. There's no reversal. There's no checking the name on the account the transfer was to. It's just gone. I do not understand why people who have legal intentions would want to be part of the crypt…

They think that government is tyranny, therefore lack of government is freedom. Yes, they are dumb as hell.

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#126

Post by openasocket »

mattbrewsbytes wrote: post #99
zaroth wrote: post #23

Earlier quoted context omitted.

Seriously. That was really really hard to read. So basically $600mm in a hot wallet and no one even watching it. Just wow. They didn’t even hack the smart contract, they just compromised 4 systems holding the private keys, and there was an RPC signing function giving free access to the 5th. Good god.

Sounds like if they had a checking account with their bank credentials stored in ENV variables and someone got access to that server it would be the same outcome. The details of it being on a crypto-currency are interesting but when password/passphrase/private key security is poor it doesn't really matter the medium holding the money.

Aren't there methods of rolling back transactions in the traditional banking system though? And additional validations on larger volume transactions?

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#127

Post by lmkg »

paxys wrote: post #88
dpiers wrote: post #31

I'm out of the loop and trying to understand - people lent over half a billion dollars of their 'real' fake money (ETH) to a game studio so they could transact on the studio's sidechain because gas fees are prohibitively expensive on ETH, and then the game studio got hacked and lost it all? How was this ever going to end any other way? Imagine how preposterous the idea of storing $650mm in USD in a random game studio…

Giving $650mm in USD to a random company is still infinitely safer than doing so with crypto. If a regulated bank claims they got hacked and lost that amount, there are a slew of federal and state laws and agencies in place to investigate it. With crypto, it could very well be in the wallet of the CEO or IT guy and no one would know.

Unlike traditional banks with their burdensome regulations and gate-keepers, the permissionless, decentralized nature of the blockchain means that they can't get the money back.

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#128

Post by wpasc »

bastardoperator wrote: post #98
rinze wrote: post #74

Earlier quoted context omitted.

> Imagine how preposterous the idea of storing $650mm in USD in a random game studio's checking account would be. But it's decentralized. (Do the same hand movement as if saying "It's got electrolytes")

Apparently plants crave it though...

Mutilate your thirst

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#129

Post by mrits »

mattbrewsbytes wrote: post #99
zaroth wrote: post #23

Earlier quoted context omitted.

Seriously. That was really really hard to read. So basically $600mm in a hot wallet and no one even watching it. Just wow. They didn’t even hack the smart contract, they just compromised 4 systems holding the private keys, and there was an RPC signing function giving free access to the 5th. Good god.

Sounds like if they had a checking account with their bank credentials stored in ENV variables and someone got access to that server it would be the same outcome. The details of it being on a crypto-currency are interesting but when password/passphrase/private key security is poor it doesn't really matter the medium holding the money.

It would be much different outcome that would probably lead to recovering the money.

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#130

Post by thegeomaster »

xiphias2 wrote: post #25

,, Originally, Sky Mavis chose the five out of nine threshold as some nodes didn’t catch up with the chain, or were stuck in syncing state’’ Sounds like a great plan for storing half billion dollars. I’m not blaming the developers, as they are incentivized to move fast and break things, I’m just sorry for all the people who trust new protocols so easily without any knowledge in safe software security practices. Perso…

I am blaming the developers.

Perhaps this is not a popular view, but this "blameless" culture is fine and good when it's a random service going down for 15 minutes and you're trying to collaborate and prevent it from happening again.

There must be limits though. If you're handling that amount of money in a bank and you fuck it up like this, your ass is on the line, together with the ones who incentivized you to move fast and break things. This should be no different.

Post reply on HN