Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

$625M worth of ETH drained on Axie Infinity's Ronin Network

roninblockchain.substack.com

Post reply on HN
Print view View original

251–260 of 761 posts

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#251

Post by babyshake »

mhitza wrote: post #119
red_admiral wrote: post #62

Echoes of Mt Gox: when something meant to be a much smaller operation (such as a place to trade Magic:The Gathering cards) suddenly finds itself playing a much bigger game. It's like you agreed to temporarily store the Fort Knox gold reserves in your spare room, but still have the same ordinary lock on the front door.

> Fort Knox gold reserves in your spare room What do you mean a wooden safe isn't good enough?! Joke aside. This is the reality we live in. Almost makes heist movies pale in comparison. The failed Die Hard heist was planned in order to steal $640M. I wonder how long until Hollywood will start making movies about these hacks.

> I wonder how long until Hollywood will start making movies about these hacks.

I'm guessing they would portray it as being in the "metaverse" so they get to actually show a physical heist happening. And yes, of course that's not even remotely how any of this works but that's never stopped Hollywood before.

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#252

Post by gamblor956 »

mattbrewsbytes wrote: post #99
zaroth wrote: post #23

Earlier quoted context omitted.

Seriously. That was really really hard to read. So basically $600mm in a hot wallet and no one even watching it. Just wow. They didn’t even hack the smart contract, they just compromised 4 systems holding the private keys, and there was an RPC signing function giving free access to the 5th. Good god.

Sounds like if they had a checking account with their bank credentials stored in ENV variables and someone got access to that server it would be the same outcome. The details of it being on a crypto-currency are interesting but when password/passphrase/private key security is poor it doesn't really matter the medium holding the money.

Transferring $650 million out of a corporate bank account would usually require in-person approval by a C-level officer, or at the very least, prior notice to the bank of the transaction.

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#253

Post by anchpop »

Barrera wrote: post #225

This is the kind of pain that comes from trusting scammers and nincompoops about unworkable blockchain "scalability" fixes. Here's the sequence. Those dumb enough to ignore it are doomed to repeat the pattern. I'm probably getting some details wrong in this Rube Goldberg scheme, so feel free to correct. 1. Citing "Ethereum network congestion," Axie Infinity announces an ethereum side chain, Ronin.[1] 2. Ronin was a c…

Right now they're immature, but I'm hopeful that advancements in ZK-tech will allow practical ZK-rollups. ZKSync already has a zk-evm testnet running (which I believe is based on zk-llvm), so we're close. Currently all the big rollups have master keys which can be used to steal all the money deposited by them, but there's no reason in principle they have to have this. Polygon has permissionless rollups, so I'm quite hopeful that they'll be a viable trustless permissionless scaling solution soon.

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#254

Post by jonny_eh »

Barrera wrote: post #225

This is the kind of pain that comes from trusting scammers and nincompoops about unworkable blockchain "scalability" fixes. Here's the sequence. Those dumb enough to ignore it are doomed to repeat the pattern. I'm probably getting some details wrong in this Rube Goldberg scheme, so feel free to correct. 1. Citing "Ethereum network congestion," Axie Infinity announces an ethereum side chain, Ronin.[1] 2. Ronin was a c…

> 4. An attacker obtained 5 of 9 keys, which is the signing threshold.

How?

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#255

Post by Obi_Juan_Kenobi »

gonehome wrote: post #50
shakezula wrote: post #30

Earlier quoted context omitted.

You’re describing a hard fork - exactly what created Ethereum and Ethereum Classic after the DAO hack. Even now it’s still considered a controversial move.

I think the majority sided with the move (which is why Ethereum soldiers on and EC is basically useless). It's a good final social check on bad behavior. I think Vitalik as written about this (I'm pretty sure I read about it in one of his long form posts).

Forking is absolutely central to cryptocurrency. In the end, these are just rule schemes for interacting and communicating about value. If no one chooses to participate in it, it has no value. If a sufficient majority would like the rules to change, then they can simply do so.

People focus on the algorithmic aspect of cryptocurrencies, but this is simply the weedy details that enable certain properties of interaction. Nothing terribly interesting has happened here since the initial idea of using proof of work to regulate authorship of a blockchain. It is the social aspect that has been interesting to follow. Alt coins, forks, and the enduring primacy of Bitcoin.

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#256

Post by FrenchDevRemote »

afpx wrote: post #164
calrain wrote: post #140

Earlier quoted context omitted.

Because there are people in the world who can wake up and have lost all money they had deposited in a bank. There are people who have to pay 20% transfer fees to move money overseas. There are people who don't have the ability to open a bank account. There are people who can lose all their banked money if their government doesn't like them. The first world doesn't have these problems. Crypto is a bigger play than 'ge…

Where in the world is it common to lose all money deposited in a bank? And, why not just create better banks?

I'm not a supporter of cryptos.

But most really corrupt countries.

So about half the world, if not more. A large part of Africa, a large part of Asia, a good part of south America, some eastern European countries.

If you want to create better banks, you'd have to pay bribes, millions/billions of dollars of bribes. So you're back to square one because you can't operate without charging huge fees or doing dodgy things.

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#258

Post by zaroth »

jacques_chester wrote: post #158
zaroth wrote: post #44

Earlier quoted context omitted.

The only way to apply the court’s judgement (in the case of ETH) is to hark fork, because there is no governance contract in place. A blockchain can in theory support such things, which would allow a majority vote to approve the court’s judgement, but not ETH as it currently stands. Alternatively if you could get enough miners to just collectively agree to replay the blocks without that transaction you could let the…

> The only way to apply the court’s judgement (in the case of ETH) is to hark fork, because there is no governance contract in place. Courts can and do issue orders against any kind of asset in order to enforce justice and unlike smart contracts, their orders are backed by men and women with dogs and guns. Put another way: a court will not say "gee, gosh, if only ETH had a mechanism I could give orders for! I guess I…

We are talking about two different things. I’m talking about a decentralized algorithm which runs on your own machine and can reach a conclusion about a transaction being invalid even though it may have a valid signature.

For example, imagine the thief just burns the ETH. $600mm notional value is destroyed in a few bytes of crypto. Whether someone goes to jail or not is besides the point.

Can the funds be recovered, and what is the algorithmic mechanism to provide for that recovery?

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#259

Post by mfringel »

logicchains wrote: post #202
lottin wrote: post #125

Earlier quoted context omitted.

They think that government is tyranny, therefore lack of government is freedom. Yes, they are dumb as hell.

What's so dumb about the idea of wanting to be responsible for your own outcomes? You make a stupid mistake, you suffer, nobody else does. If you don't want take responsibility for your own actions, feel free to stick to the mainstream financial system. Note however that as a result of that you'll be on the hook for bailing out other people's stupid mistakes when they fuck up, like how the taxpayer bailed out banks t…

With that kind of attitude, how are you going to get more people to come in and provide you with exit liquidity?

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#260

Post by [deleted] »

kurisufag wrote: post #214
mabbo wrote: post #47

In a system run by people, the transaction could be reversed, traced, and the culprits eventually brought to justice. In a system run by algorithms, designed to avoid oversight by people (governments), there is no such powers. There's no reversal. There's no checking the name on the account the transfer was to. It's just gone. I do not understand why people who have legal intentions would want to be part of the crypt…

because it facilitates person to person interactions without oversight. if you want to raise funds for an entity or cause that is controversial, it is useful to have an option that is nigh-impossible to subvert when done correctly.

[deleted]
Post reply on HN