Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

$625M worth of ETH drained on Axie Infinity's Ronin Network

roninblockchain.substack.com

Post reply on HN
Print view View original

261–270 of 761 posts

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#261

Post by babyshake »

apeace wrote: post #236
apeace wrote: post #150

Can someone attempt to explain or speculate at what the attacker is doing with their wallet right now? https://etherscan.io/txs?a=0x098b716b8aaf21512996dc57eb0615e... As I write this at about 17:00 UTC, they seem to be doing lots of small transactions (about $1 USD), and they are coming "From" many different places, but only showing "To" the "Ronin Bridge Exploiter". I don't understand this stuff well enough to see w…

As some other commenters pointed out, those small transactions are all spam. So I decided to go back in the transaction history and look at what the attacker has done with the funds. So far, it has all been funneled (through about 2 hops), to something called "Huobi 35", e.g. this transaction[0]. Some of these have taken place in just the last few minutes (17:15 UTC or so). I'm assuming "Huobi 35" is the Huobi exchan…

Huobi is Chinese I believe. One potential side effect of countries like China "banning" cryptocurrency is that they may not be motivated to help in these situations.

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#262

Post by game_the0ry »

mabbo wrote: post #47

In a system run by people, the transaction could be reversed, traced, and the culprits eventually brought to justice. In a system run by algorithms, designed to avoid oversight by people (governments), there is no such powers. There's no reversal. There's no checking the name on the account the transfer was to. It's just gone. I do not understand why people who have legal intentions would want to be part of the crypt…

> There's no checking the name on the account the transfer was to. It's just gone.

This has happens with humans too. [1]

[1] https://www.washingtonpost.com/world/2021/10/07/ghani-afghan...

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#263

Post by ndury »

jonathan-adly wrote: post #67
jandrese wrote: post #46

Earlier quoted context omitted.

Which is what that horrible cringe rapper lady was doing when she and her boyfriend were busted.

No - they had Bitcoin, completely different beast. (due to lack of smart contracts, Bitcoin is a lot simpler/transparent/harder to hide stuff there).

> harder to hide stuff there.

AFAIK, there are coinjoin implementations which cannot be traced to date.

Do note that exchanges are not too keen on accepting coinjoined bitcoin.

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#264

Post by rootusrootus »

nkozyra wrote: post #207
jnwatson wrote: post #177

Earlier quoted context omitted.

This incident reinforces the rule never to use your debit card for credit card transactions.

Absolutely do not use your debit card ... well, anywhere if you can help it. (Apologies, saw the wrong parent comment) How many utilities, credit card companies require a checking account for autopay? How many times have you thrown out an old checkbook that contains routing and account numbers on a carbon copy pages? Bank accounts are not especially secure, we mostly hope to limit the risk/reward calculation for hack…

> How many utilities, credit card companies require a checking account for autopay?

In my experience, this is getting better! I now have all but one of my bills being paid by my credit card. Used to be that the utility companies made you pay extra and use a third party service if you wanted to use your credit card.

Not all, though. Verizon, for example, will let you pay with a credit card, but they give a substantial discount if you use a debit card instead. For obvious reasons. I hope that does not become normal. I'm used to Verizon being scummy, I hope it doesn't become the default behavior for the other utilities I pay for.

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#265

Post by Thrymr »

tormock wrote: post #146
granzymes wrote: post #84

Earlier quoted context omitted.

And if it was drained from a bank account, you have recourses to get it back.

You aren't insured for $650M in a bank account

This isn't a single user, FDIC insurance is for $250k per user per bank. The point is that for regulated banks that number is clear and if you exceed it you will be aware of it, and if you haven't exceeded it you have a federal guarantee to recover your money. What assurance does anyone have in this case?

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#266

Post by teknopaul »

MichaelGlass wrote: post #16
toyg wrote: post #3

> The attacker used hacked private keys Why do people write "hacked" instead of "stolen"? To make it look like robbing them is harder than it actually is?

If you have a legal system, then breaking my lock is unlawful intrusion, and if you take something from behind my locked door, it's theft. Without a legal system, e.g. crypto, if you solve my puzzle, then you deserve the reward. It's just math!

I don't think any math was done. They sneaked a copy of the answer.

Of course, if someone does work out the math (as they did with MD5 and sha1) it's going to be popcorn time.

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#267

Post by colinmhayes »

px43 wrote: post #157
asdfasgasdgasdg wrote: post #137

Earlier quoted context omitted.

Yes, but it's an open question how successfully and how frequently they catch the bad guys.

It's only an open question to people who haven't actually looked into it. Yeah, criminals get caught trying to move around stolen cryptocurrencies all the time.

And how many don't get caught?

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#268

Post by gowld »

profmonocle wrote: post #152
motoboi wrote: post #56

Earlier quoted context omitted.

Yes. People worked hard for electronic dollars to be transferred to their electronic wallets. They tried to use some of that digital money (in another electronic format) in a digital game, but the game got hacked and now those dollars are someone’s else dollars. The hacker may have some difficulty transforming digital money into paper bills, because KYC, but he can launder it like old school people used to and have s…

> but he can launder it like old school people used to and have some. Crypto provides exciting new ways to do that, too. First send it through a mixer service. Then, invest in some new NFT project. Six months later, oh nice, someone bought your NFT for 10x what you paid for it. What a great investment.

Selling NFT for over >$1000 should trigger an investigation into provenance of the funds.

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#269

Post by toyg »

CydeWeys wrote: post #6
toyg wrote: post #3

> The attacker used hacked private keys Why do people write "hacked" instead of "stolen"? To make it look like robbing them is harder than it actually is?

What meaningful distinction is drawn by using one of these words over the other? "Hacked" typically implies it happened over the net, whereas "stolen" typically implies it physically happened in person. The former is more appropriate here, no?

I guess I'm old, but "hacked" to me typically involves trickery in manipulating the object itself, not just exfiltrating it. You hack a system to copy data, you don't "hack data". If you say you hacked keys, I expect you manipulated those keys with some crypto wizardry, but in this case it just means somebody somehow obtained them somehow.
Post reply on HN