Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

$625M worth of ETH drained on Axie Infinity's Ronin Network

roninblockchain.substack.com

Post reply on HN
Print view View original

291–300 of 761 posts

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#291

Post by onebot »

jonny_eh wrote: post #254
Barrera wrote: post #225

This is the kind of pain that comes from trusting scammers and nincompoops about unworkable blockchain "scalability" fixes. Here's the sequence. Those dumb enough to ignore it are doomed to repeat the pattern. I'm probably getting some details wrong in this Rube Goldberg scheme, so feel free to correct. 1. Citing "Ethereum network congestion," Axie Infinity announces an ethereum side chain, Ronin.[1] 2. Ronin was a c…

> 4. An attacker obtained 5 of 9 keys, which is the signing threshold. How?

Exactly. Sounded like the obtained four keys and then used an open backdoor RPC call to obtain the fifth.

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#292

Post by tshaddox »

jonny_eh wrote: post #254
Barrera wrote: post #225

This is the kind of pain that comes from trusting scammers and nincompoops about unworkable blockchain "scalability" fixes. Here's the sequence. Those dumb enough to ignore it are doomed to repeat the pattern. I'm probably getting some details wrong in this Rube Goldberg scheme, so feel free to correct. 1. Citing "Ethereum network congestion," Axie Infinity announces an ethereum side chain, Ronin.[1] 2. Ronin was a c…

> 4. An attacker obtained 5 of 9 keys, which is the signing threshold. How?

> The attacker used hacked private keys in order to forge fake withdrawals.

> The attacker managed to get control over Sky Mavis’s four Ronin Validators and a third-party validator run by Axie DAO.

Easiest explanation: at least one Sky Mavis employee and one Axie Infinity employee who have access to those private keys got together and took all the funds. Perhaps it was only one employee; it's not clear to me what the difference between Axie Infinity and Sky Mavis is (there isn't actually an Axie DAO, there's just a web page where they say they plan to be a DAO in 2023).

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#293

Post by erdeszt »

vmception wrote: post #226
erdeszt wrote: post #166

> We are working directly with various government agencies to ensure the criminals get brought to justice. It's amusing to see these kind of statements from the decentralized no goverment/no authorities crowd. To quote RKL: Well it's anarchy, fuck the cops Of course, how else, through peace. But when the looters come to kick your ass I bet you cry "Police!"

> It's amusing to see these kind of statements from the decentralized no goverment/no authorities crowd I see this meme and I don't get it Why do you think this studio was a no government no authorities crowd? I havent seen anything from Axie or its founders that suggested that, my assumption is that you see one word or one piece of technology that overlaps with the aspirations of completely different people that are…

> Why do you think this studio was a no government no authorities crowd?

I meant the general web3/cryptobro crowd

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#294

Post by Miner49er »

babyshake wrote: post #275
Miner49er wrote: post #227

Earlier quoted context omitted.

This isn't a case where there was a flaw in a smart contract. This is a case where they straight up hacked servers and stole keys from them.

Even exploiting a flaw in a smart contract is theft as long as it is clearly an exploit.

As far as I know, this hasn't been tested in court. Even if true, this goes completely against the idea of "the code is law."

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#295

Post by HWR_14 »

tormock wrote: post #146
granzymes wrote: post #84

Earlier quoted context omitted.

And if it was drained from a bank account, you have recourses to get it back.

You aren't insured for $650M in a bank account

The FDIC insurance of $250,000 is by the government in case the bank becomes insolvent. The FDIC can easily cover $650 MM in a single bank that has 3,000+ customers. Or really even fewer than that with multiple account types.

But even then, if you store $650 MM in a Bank of America account, that money is protected against being stolen by BOA's anti-fraud software, laws, the trillions of dollars of assets BOA has.

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#296

Post by lolinder »

nightpool wrote: post #209
lolinder wrote: post #169

Earlier quoted context omitted.

And do that every time a hack occurs? What would the threshold be for when that would be worth it? Could I recover $100k that got stolen? What about $10k? $1k?

Sure, why not? You could even automate it, using a SWIFT-like messaging pipeline that all mining companies have to subscribe to. Blockchains are fundamentally a social construct, and governments have the ability to regulate the individuals who are creating the blockchain. If there was enough political will for it, you could absolutely bolt a "reversal" mechanism onto any existing blockchain. Unless you're doing your…

What you have when you're done with the process you've described is a centralized banking system managed by world governments, which is what we already have. It's not perfect, but it works, and lots of people are actively working on improving it in ways that don't involve the contradiction inherent in centralized decentralization.

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#297

Post by nightpool »

lolinder wrote: post #296
nightpool wrote: post #209

Earlier quoted context omitted.

Sure, why not? You could even automate it, using a SWIFT-like messaging pipeline that all mining companies have to subscribe to. Blockchains are fundamentally a social construct, and governments have the ability to regulate the individuals who are creating the blockchain. If there was enough political will for it, you could absolutely bolt a "reversal" mechanism onto any existing blockchain. Unless you're doing your…

What you have when you're done with the process you've described is a centralized banking system managed by world governments, which is what we already have. It's not perfect, but it works, and lots of people are actively working on improving it in ways that don't involve the contradiction inherent in centralized decentralization.

Yes? That's the point of my comment? I'm confused about what you're saying. I'm trying to answer your question "And do that every time a hack occurs?". The answer is yes, it's completely feasible and within the powers of a government or inter-government treaty organization to do this every time a hack occurs, because they already do. I'm not trying to say that such a system is good, just that it's possible. There is nothing "special" about blockchains that exempts them from normal government regulation.

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#298

Post by Jxl180 »

Miner49er wrote: post #242
vmception wrote: post #226

Earlier quoted context omitted.

> It's amusing to see these kind of statements from the decentralized no goverment/no authorities crowd I see this meme and I don't get it Why do you think this studio was a no government no authorities crowd? I havent seen anything from Axie or its founders that suggested that, my assumption is that you see one word or one piece of technology that overlaps with the aspirations of completely different people that are…

What other value is there in cryptocurrency over traditional money?

Traditional money as in cash? Mailing cash to someone on the other side of the world is not ideal. Trusting PayPal or Stripe to not arbitrarily freeze your account because they think you’re making too much money too quickly is not ideal. Having to show ID to send or receive a money order is not ideal.

That doesn’t mean I don’t condone the government prosecuting thieves who steal crypto.

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#299

Post by Jerrrry »

vmception wrote: post #289
Jerrrry wrote: post #244

Earlier quoted context omitted.

Quoted post unavailable.

Here is one of many styles of telegram channels that promote newly launched tokens on Uniswap solely for the gamble and fun https://t.me/goobygambles

the premise is, though, to lure in others via 1000% fomo -- that is only inflated because of the user buying the questionable tokens, then use their capital for exit liquidity?

seems pretty simple

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#300

Post by teknopaul »

cesaref wrote: post #41
bruce511 wrote: post #21

Earlier quoted context omitted.

I'm not sure I agree. I mean secrets can be stolen. Apparently pirating music or movies is theft and so on. We've often seen the naritive of Big company stealing ideas etc from smaller companies. So stealing can extend beyond simple physical property, and could acceptably encompass IP as well.

It's a smart move by the entertainment industry to try to rebrand piracy as theft, as the public at large understand theft as a bad thing. Legally though I think it's 'copyright infringement' which sounds a lot less sexy.

Certainly in the UK theft is "taking possession with intent to permanently deny the owner of it". Copyright infringement is not theft by that definition.

Saw this great stand-up skit by someone who was asked to compare copyright infringement to stealing a car...

It like stealing a car but You just stick you finger out, touch the car, and it's your car!

And the owner still has the car!

And literally all my friends do it!

Post reply on HN