Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

$625M worth of ETH drained on Axie Infinity's Ronin Network

roninblockchain.substack.com

Post reply on HN
Print view View original

281–290 of 761 posts

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#281

Post by bombcar »

apeace wrote: post #236
apeace wrote: post #150

Can someone attempt to explain or speculate at what the attacker is doing with their wallet right now? https://etherscan.io/txs?a=0x098b716b8aaf21512996dc57eb0615e... As I write this at about 17:00 UTC, they seem to be doing lots of small transactions (about $1 USD), and they are coming "From" many different places, but only showing "To" the "Ronin Bridge Exploiter". I don't understand this stuff well enough to see w…

As some other commenters pointed out, those small transactions are all spam. So I decided to go back in the transaction history and look at what the attacker has done with the funds. So far, it has all been funneled (through about 2 hops), to something called "Huobi 35", e.g. this transaction[0]. Some of these have taken place in just the last few minutes (17:15 UTC or so). I'm assuming "Huobi 35" is the Huobi exchan…

There are no authorities who understand this enough to operate that quickly. By the time any authorities care, it'll be long gone from Huobi.

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#282

Post by henriquecm8 »

zaroth wrote: post #23
outsb wrote: post #15

Over half a billion in assets and.. > We discovered the attack this morning after a report from a user Fuck me.

Seriously. That was really really hard to read. So basically $600mm in a hot wallet and no one even watching it. Just wow. They didn’t even hack the smart contract, they just compromised 4 systems holding the private keys, and there was an RPC signing function giving free access to the 5th. Good god.

> they just compromised 4 systems holding the private keys, and there was an RPC signing function giving free access to the 5th.

This seems like the plot of a 90's hacker movie.

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#283

Post by HWR_14 »

leifg wrote: post #186
chippiewill wrote: post #155

Earlier quoted context omitted.

In principle if you had enough desire among world governments you could plausibly try and legally force a blockchain fork.

Even if that is desired and wouldn't spark a philosophical debate about wether centralized entities should get involved at all, there is a much deeper problem. Every transaction that is occurring now on the chain will be invalidated. That means you can't even reverse a single transaction you will have to reverse one transaction and ALL other transactions that happened after the one you want to reverse. If that happen…

You wouldn't have to reverse all the transactions. You could trivially create a fork (which has to be longer, and therefore have more transactions available) that includes every transaction but one from the blockchain. Well, that is you can create that fork as trivially as you can create any other fork.

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#284

Post by toyg »

MichaelGlass wrote: post #16
toyg wrote: post #3

> The attacker used hacked private keys Why do people write "hacked" instead of "stolen"? To make it look like robbing them is harder than it actually is?

If you have a legal system, then breaking my lock is unlawful intrusion, and if you take something from behind my locked door, it's theft. Without a legal system, e.g. crypto, if you solve my puzzle, then you deserve the reward. It's just math!

Steal, copy, exfiltrate, obtain - that's not the point.

The point is that hacking, when transitive, involves manipulating an object. It is not a synonym for "copy". When people use it like that, it's typically to hide the fact that their (human or technical) systems were so bad that somebody managed to copy data they should not have. "They hacked keys!!11!" - No, something or somebody gave them keys, but you want us to believe that it required incredible skills.

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#285

Post by Hackbraten »

Loughla wrote: post #222
jnwatson wrote: post #177

Earlier quoted context omitted.

This incident reinforces the rule never to use your debit card for credit card transactions.

Ever, never, never use your debit card where credit card can be used in its place. The mechanisms for restoring the charge on your credit card are much stronger than on your debit card. And a credit card is a FUTURE charge, so you have time to fix the problem. Whereas a debit card is your CURRENT money, so it's just gone unless you get it back. I do not understand why people use debit cards linked to their actual ban…

I have stopped using credit cards for two reasons:

1. My debit cards allow me to directly import transactions into my personal accounting software while my credit cards don’t; and

2. when I shop online, my debit cards allow me to use them as a 2nd factor (using a USB card reader) while my credit cards require either an iOS or Android device for 2FA.

You’re right in that a credit card is a future charge and debit isn’t. But are debit cards really so much more insecure? What threat model do you have in mind?

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#286

Post by jonathan-adly »

Barrera wrote: post #225

This is the kind of pain that comes from trusting scammers and nincompoops about unworkable blockchain "scalability" fixes. Here's the sequence. Those dumb enough to ignore it are doomed to repeat the pattern. I'm probably getting some details wrong in this Rube Goldberg scheme, so feel free to correct. 1. Citing "Ethereum network congestion," Axie Infinity announces an ethereum side chain, Ronin.[1] 2. Ronin was a c…

1. Can your "blockchain" be validated with regular hardware?

2. Does it use a secure consensus algorithm?

3. Is there a secure side channel through which low-value transactions can flow?

The only blockchain with 3 yes is Bitcoin lol.

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#287

Post by cechmaster »

ozten wrote: post #121

"We are working with law enforcement officials..." If the promise of ETH contracts is that code is law and to eliminate needing trust, then how and why would law enforcement get involved? Did the attackers break down the door and steal the money? Or did the provide a widget that met the contract and which just happened to have the unfortunate side-effect of siphoning off tokens, a bug which will be fixed in the next…

People pay a lot of taxes for their crypto trades.

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#288

Post by babyshake »

hinkley wrote: post #70

Something tells me that if indeed cryptocurrency sticks around it’s going to sprout rules and regulations that are a mix of banking and securities regulations, and that will suck most of the “fun” out of it. We pause the stock market on a 5% drop and stoop it on 10%. Moving that much crypto in a day is probably never on purpose. Though in a distributed consensus system I don’t know how you’d enforce such a thing.

> We pause the stock market on a 5% drop and stoop it on 10%.

Crypto: Hold my cascading liquidity.

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#289

Post by vmception »

Jerrrry wrote: post #244
vmception wrote: post #216

Earlier quoted context omitted.

No they’ll add some liquidity to Tornado cash And then a bunch of other large hacks will notice that Tornado cash is big enough to handle their large amounts too, adding more liquidity to Tornado cash And then some FAANG engineer is going to take their clean $50k paycheck and buy into a new launched token on Uniswap And that token is going to rally 100x because the tornado cash withdrawals keep buying that token And…

Quoted post unavailable.

Here is one of many styles of telegram channels that promote newly launched tokens on Uniswap solely for the gamble and fun

https://t.me/goobygambles

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#290

Post by godot »

tommiegannert wrote: post #193
mabbo wrote: post #47

In a system run by people, the transaction could be reversed, traced, and the culprits eventually brought to justice. In a system run by algorithms, designed to avoid oversight by people (governments), there is no such powers. There's no reversal. There's no checking the name on the account the transfer was to. It's just gone. I do not understand why people who have legal intentions would want to be part of the crypt…

I think this is where insurance companies generally pop up as a solution. I.e. the same solution as with regular bank accounts. Layering humans on top of algorithms makes sense. We already have SWIFT and networks layered under humans in the fiat system, so now we're just pushing more complex algorithms. In the case of block chains, I'd say the concept of asymmetric cryptography is an improvement over mutual trust in…

I'll actually try to add and defend crypto a little bit here:

> I think this is where insurance companies generally pop up as a solution.

Real legitimate DeFi protocols are now often supported by DeFi insurance as well. I know nothing about Axie Infinity and have no idea if this applies for them at all.

> (still thinking it's a solution waiting for a problem)

IMO, although this has been said many times the past few years, I think we're starting to get past this. In a very simplified view, DeFi protocols that do lending (e.g. loans based on collaterals), can do this fully automated, and it's because "the money is programmable" thanks to smart contracts and value stored. This type of lending took human work to do in TradFi and has overhead, in both costs and speed. I feel like this is the start of what real solutions/applications look like; it's something that wasn't possible before.

Post reply on HN