Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

$625M worth of ETH drained on Axie Infinity's Ronin Network

roninblockchain.substack.com

Post reply on HN
Print view View original

341–350 of 761 posts

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#341

Post by Symbiote »

rootusrootus wrote: post #264
nkozyra wrote: post #207

Earlier quoted context omitted.

Absolutely do not use your debit card ... well, anywhere if you can help it. (Apologies, saw the wrong parent comment) How many utilities, credit card companies require a checking account for autopay? How many times have you thrown out an old checkbook that contains routing and account numbers on a carbon copy pages? Bank accounts are not especially secure, we mostly hope to limit the risk/reward calculation for hack…

> How many utilities, credit card companies require a checking account for autopay? In my experience, this is getting better! I now have all but one of my bills being paid by my credit card. Used to be that the utility companies made you pay extra and use a third party service if you wanted to use your credit card. Not all, though. Verizon, for example, will let you pay with a credit card, but they give a substantial…

The US needs an automatic bill payment system with strong guarantees.

In Britain, most people¹ pay bills (electricity, water, phone, internet, insurance, car loan, credit card etc) by "Direct Debit"². (Most European countries have a similar system with similar guarantees, but this one is described in English.)

If anything should go wrong, the bank must fix it. There's a list of direct debits in the bank's interface, and they can be cancelled/suspended with one click (or by phoning or going to the bank).

It isn't perfect (see 3 from two weeks ago) but that sort of problem is rare enough that it was reported in newspapers.

¹ "Direct Debits are used by nine in ten UK consumers to pay some or all of their regular bills".

² https://www.directdebit.co.uk/DirectDebitExplained/Pages/Dir...

³ https://www.moneysavingexpert.com/news/2022/03/tsb-customers...

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#342

Post by hotpotamus »

UncleMeat wrote: post #92
RL_Quine wrote: post #33

Earlier quoted context omitted.

No monitoring whatsoever over $600M of funds stored in your system is crazy negligent.

It isn't like monitoring would have done anything. Once the transaction goes out it is gone. The core problem here is the massive private-key bounty being created by a ton of organizations that don't have world-class security teams.

Yeah, I'm just picturing a Graphana chart going from $625M to $0. And then admins sitting around like, OK, now what?

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#343

Post by malfist »

mnumber wrote: post #115
malfist wrote: post #91

Earlier quoted context omitted.

Arguably it's the same risk as holding paper notes right? If I steal your life savings from under your mattress, there isn't necessarily anything to trace it back to me. However, there is a physical limit, pretty damn hard to run off with half a billion worth of paper notes.

Why did you equally conflate the risks then immediately back peddle and say "physically stealing is harder i guess"?

I guess it comes across as me saying cash and crypto are equal. They're not. I was just trying to add nuance to the conversation.

I am wholeheartedly a supporter of centralized, fiat currencies.

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#344

Post by blueprint »

mabbo wrote: post #47

In a system run by people, the transaction could be reversed, traced, and the culprits eventually brought to justice. In a system run by algorithms, designed to avoid oversight by people (governments), there is no such powers. There's no reversal. There's no checking the name on the account the transfer was to. It's just gone. I do not understand why people who have legal intentions would want to be part of the crypt…

because there are benefits for specific use cases to not requiring a human to be involved, mainly things like censorship .. in other words not something most people would need but something few can find zero other solutions for

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#345

Post by TylerE »

Hackbraten wrote: post #285
Loughla wrote: post #222

Earlier quoted context omitted.

Ever, never, never use your debit card where credit card can be used in its place. The mechanisms for restoring the charge on your credit card are much stronger than on your debit card. And a credit card is a FUTURE charge, so you have time to fix the problem. Whereas a debit card is your CURRENT money, so it's just gone unless you get it back. I do not understand why people use debit cards linked to their actual ban…

I have stopped using credit cards for two reasons: 1. My debit cards allow me to directly import transactions into my personal accounting software while my credit cards don’t; and 2. when I shop online, my debit cards allow me to use them as a 2nd factor (using a USB card reader) while my credit cards require either an iOS or Android device for 2FA. You’re right in that a credit card is a future charge and debit isn’…

If your credit card is compromised, you make a phone call and maybe can't use it for a few days.

If your debit card gets compromised, your rent check bounces.

Plus, frankly, banks are generally more protective of THIER money than YOUR money.

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#346

Post by mwattsun »

rinze wrote: post #74
dpiers wrote: post #31

I'm out of the loop and trying to understand - people lent over half a billion dollars of their 'real' fake money (ETH) to a game studio so they could transact on the studio's sidechain because gas fees are prohibitively expensive on ETH, and then the game studio got hacked and lost it all? How was this ever going to end any other way? Imagine how preposterous the idea of storing $650mm in USD in a random game studio…

> Imagine how preposterous the idea of storing $650mm in USD in a random game studio's checking account would be. But it's decentralized. (Do the same hand movement as if saying "It's got electrolytes")

My favorite is the supposed "special properties" of copper. I once knew someone who swore by the healing properties of copper.

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#347

Post by rchaud »

moralestapia wrote: post #117
rinze wrote: post #74

Earlier quoted context omitted.

> Imagine how preposterous the idea of storing $650mm in USD in a random game studio's checking account would be. But it's decentralized. (Do the same hand movement as if saying "It's got electrolytes")

Let's just call the bank and see if ... * It's decentralized * Oh, crap.

Customer support answers for most things crypto is of the "the fault is yours alone" variety.

Reminds me of the line in 30 Rock:

"Gentlemen, we have moved our customer support offices to a part of India that has no telephone service. We're now providing the same quality of service at zero the cost".

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#348

Post by mdoms »

> We are working with law enforcement officials, forensic cryptographers, and our investors to make sure all funds are recovered or reimbursed. All of the AXS, RON, and SLP on Ronin are safe right now.

In which crypto bros once again discover that centralised authorities are not entirely redundant.

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#349

Post by ethbr0 »

anchpop wrote: post #253
Barrera wrote: post #225

This is the kind of pain that comes from trusting scammers and nincompoops about unworkable blockchain "scalability" fixes. Here's the sequence. Those dumb enough to ignore it are doomed to repeat the pattern. I'm probably getting some details wrong in this Rube Goldberg scheme, so feel free to correct. 1. Citing "Ethereum network congestion," Axie Infinity announces an ethereum side chain, Ronin.[1] 2. Ronin was a c…

Right now they're immature, but I'm hopeful that advancements in ZK-tech will allow practical ZK-rollups. ZKSync already has a zk-evm testnet running (which I believe is based on zk-llvm), so we're close. Currently all the big rollups have master keys which can be used to steal all the money deposited by them, but there's no reason in principle they have to have this. Polygon has permissionless rollups, so I'm quite…

For those who don't follow blockchain tech, like me, here's a primer on ZK-rollups: https://learn.bybit.com/blockchain/zk-rollups-eth-scalabilit...

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#350

Post by HWR_14 »

leifg wrote: post #314
HWR_14 wrote: post #283

Earlier quoted context omitted.

You wouldn't have to reverse all the transactions. You could trivially create a fork (which has to be longer, and therefore have more transactions available) that includes every transaction but one from the blockchain. Well, that is you can create that fork as trivially as you can create any other fork.

Sure maybe. But that only really works if few (if not all) entities have control over the consensus mechanism. On a regular PoW blockchain you will have to recalculate all the hashes according to the difficulty which will up to the miners. But even if you could, it's an absolute technical nightmare. To build an analogy that somehow fits. If you have git repo and you find out that a particular commit that you want to…

When you first responded to chippiewillie you talked about how forking would produce a reversal of all the transactions. That's not true, but it is what you identified as a "much deeper problem"
Post reply on HN