Live data from Hacker News

$625M worth of ETH drained on Axie Infinity's Ronin Network

roninblockchain.substack.com

471–480 of 761 posts

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#471

> All of the AXS, RON, and SLP on Ronin are safe right now. Of course they are. They're worthless.

Surprisingly, AXS and SLP are only down about 6% on Coinbase. So, sell now before it's too late. They've both been going down for months, anyway.

There may not be buyers. Who would buy now ?

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#472

Earlier quoted context omitted.

That's all well and good when the thieves are in the US or a country that will extradite them. What happens when the thieves are operating out of a country without an extradition treaty? In the regular financial world you can at least reverse the transaction. With crypto, is there anything you can do?

In principle if you had enough desire among world governments you could plausibly try and legally force a blockchain fork.

You'd have to be forking it once a week, because there is so much stealing going on. We'd probably end up with a weekly split. Imagine how crazy that is. And of course people would make false stealing claims. Maybe you are on vacation when they reverse something that takes your money, because you have a chance to weigh in.

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#473
post #273

Earlier quoted context omitted.

It's in the article. Keys were stolen.

Thank you, I missed that detail. I do think the larger question of DAOs replacing trust with code/law is worth further discussion.

After following the DeFi space for over a year now I've come to the conclusiong that "code is law" is a fallacy. If you come to the possession of funds that were not intended to be in your possession by exployting bugs or vulnerabilities, and other parties are significantly harmed in this process, then you will be in a position to face criminal charges... Well that is unless one can maintain anonymity indefinitely. Once anonymity is lost law enforcement may come for you.

The best thing you can do (and the moral thing to do) is to submit for a bug bounty in case you find a crictical bug in a blockchain/protocol.

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#474

Earlier quoted context omitted.

1. Can your "blockchain" be validated with regular hardware? 2. Does it use a secure consensus algorithm? 3. Is there a secure side channel through which low-value transactions can flow? The only blockchain with 3 yes is Bitcoin lol.

Actually it's Chia. Bitcoin requires custom hardware. Chia does not - you can use an ordinary hard drive and run a full node on a Raspberry Pi.

the only reason chia doesn't have specialized hardware that crowds out all commodity hardware is because no one cares about chia. the reason that bitcoin has highly specialized asics is because it is the progenitor and center of the entire cryptocurrency ecosystem and has been for over a decade. also proof of space is no better than proof of work at scale. it will ultimately have very similar consequences.

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#475

Earlier quoted context omitted.

> Easiest explanation: at least one Sky Mavis employee and one Axie Infinity employee who have access to those private keys got together and took all the funds Easier explanation: they were all in a Dropbox or something stupid like that.

Is there a chance they were all loaded into application memory?

[deleted]

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#476
post #458

Earlier quoted context omitted.

This is exactly why crypto is such a disaster. Every week there is yet another scam where people losing their money. The feedback from crypto enthusiasts is well look at those idiots for putting their money into some scheme or you are not smart enough use this thing. Look "nobody" understands what you are talking about. These financial systems are inscrutable and the problem is getting worse. You are building systems…

You are neglecting to mention the great upsides in crypto currency. * Giving criminals and scammers the ability to exchange goods and services anonymously. * Providing a source of funding North Korea's nuclear weapons program * Allowing nation states to engage in global commerce despite sanctions because they won't stop killing innocent people * Convincing older and gullible people to give their money to someone they…

>* Giving criminals and scammers the ability to exchange goods and services anonymously.

I don't see how this is any different than the bog standard "encryption lets criminals and scammers the ability to exchange goods and services anonymously.". Should money/txns be fundamentally track-able/examinable/un-encrypted but your private data/messages not?

Surely this contention is something you also consider -- care to expand?

>* Convincing older and gullible people to give their money to someone they don't know and a technology they can't explain

I am surprised. My initial viewpoint was why would scammers bother to fish for bitcoin when bank transfers/gift cards are a lower barrier -- but seems you are right [1], the cat and mouse chase continues...

[1] https://www.youtube.com/results?search_query=kitboga+bitcoin

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#477

Earlier quoted context omitted.

The crypto(graphy) is rarely the weakness in these situations, so declaring faith in (insert new tech buzzword here) is almost certainly not going to be the answer. It comes down to operational and human factors, like poorly written code. (new tech buzzword) will involve lots of new code, and why do people think this time the new code will be error-free?

In this case, the weakness was that the keys that controlled the bridge were somehow stored insecurely. When attackers gained access to the keys, they were able to steal from the bridge. In a properly-implemented rollup, there are no keys to secure, so this attack vector is ruled out. But more broadly, there is really nothing else with the same security properties as a smart-contract-enabled cryptocurrency. Paypal wi…

You are misinformed. With most cryptocurrencies (except Monero) it is very easy to blacklist wallets, and since tx history is public you can't just move your coins to a new address to get around it either. You don't actually even need decentralized systems for private transactions, digicash with blind signatures would be private and vastly more efficient.

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#478

Earlier quoted context omitted.

It's not at all. The worst thing a centralized server can do in Lightning is refuse to route your transactions. Their peers have the keys and the pre-signed transactions necessary to unilaterally withdraw their funds from the channel.

> The worst thing a centralized server can do in Lightning is refuse to route your transactions. This is called censorship, the very thing Bitcoin was created to circumvent. It's an especially big problem given the fact that the vast majority of lightning payments are routed through lightning nodes operated by centralized cryptocurrency exchanges. Most of the remaining nodes on the lightning network are unreliable du…

they can't censor you. this is incorrect. all they can do is inconvenience you. ultimately you can close the channel with them at any time if you conclude they are a bad actor.

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#479

Earlier quoted context omitted.

The chance of $650 million being drained from a game studio’s bank account is significantly less than it being drained from their ETH wallets, at least as of now.

Depends on if the studio's bank account has security questions like "mother's maiden name", "first concert", etc type stuff and an employee with those answers that like to take quizzes on facebook. Otherwise, it could be quite simple to drain the account

Just like SMS access to 'mfa' your bank account also provides an attack vector if they steal your number, stupid (aka all find-able) security questions don't help protect, they are another attack vector. I thought everyone puts fake answers and keeps them in a separate location. Then of course someone can come in an steal them too!

Since 16 year olds can hack into auth providers like okta and then hack into microsoft and steal source code, and this crypto stealing endless happens, there's just not good electronic security. But what is good is I can go to my bank in person and fix things. It would be so much harder for someone to get fake id. I actually have a personal relationship with my advisor at my 401k. Those things do give me some additional security, at least I think so.

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#480
post #248

Earlier quoted context omitted.

True, but you would think they’d notice $650,000,000 missing before a user reported an issue withdrawing $5,000 (edit - 5k ETH). It’s honestly so impossible to believe that I’d wager the real story is they knew and were actively trying to recover the funds.

just a poke: it was 5K Eth ($16,924,050), not 5K USD, but i agree with your wager.

God damn, 17 million stolen forever from 1 person and there is nothing they can do about it.
Post reply on HN