Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

$625M worth of ETH drained on Axie Infinity's Ronin Network

roninblockchain.substack.com

Post reply on HN
Print view View original

491–500 of 761 posts

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#491

Post by Hackbraten »

TylerE wrote: post #345
Hackbraten wrote: post #285

Earlier quoted context omitted.

I have stopped using credit cards for two reasons: 1. My debit cards allow me to directly import transactions into my personal accounting software while my credit cards don’t; and 2. when I shop online, my debit cards allow me to use them as a 2nd factor (using a USB card reader) while my credit cards require either an iOS or Android device for 2FA. You’re right in that a credit card is a future charge and debit isn’…

If your credit card is compromised, you make a phone call and maybe can't use it for a few days. If your debit card gets compromised, your rent check bounces. Plus, frankly, banks are generally more protective of THIER money than YOUR money.

> If your debit card gets compromised, your rent check bounces.

I guess that depends on the bank and the country you live in.

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#492

Post by smoyer »

With each of these breaches, we're approaching a point where all coins will be considered tainted. When that happens do we jump into a different crypto-currency?

It's also interesting that stolen coins are really hard to spend - more analysis seems possible as law enforcement learns how these systems work. What if a criminal shorted a coin, breached the system causing a giant loss and then profited from the short sell (and never touched the stolen coins?)

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#493

Post by sfe22 »

rossjudson wrote: post #397
ChrisLomont wrote: post #243

Earlier quoted context omitted.

What percent of BTC has been stolen? What percent of USD has been stolen? And that shows the difference in how each is protected.

Interesting thought. Bitcoin circulates, and you have to wonder how much of it has passed through a fraudulent transaction -- at any time in the past. Someday when it becomes straightforward to walk the entire life of bitcoin backwards, there may be people who want their bitcoin back...because it's stolen property. If A has a TV, B steals the TV and sells it to C, who sells it to D...then the TV is still returned to…

But bitcoin can be mixed, how do you decide which of the next transactions contain your part of stolen bitcoins?

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#494

Post by acdha »

imtringued wrote: post #439
yunohn wrote: post #411

Earlier quoted context omitted.

Well, in this particular case, the keys got stolen. Which is a massive crypto UX issue.

If its a UX issue then are you implying that wallets should have certain security levels that limit their maximum account balance? I mean mandatory multi sig for anything above $1 million. Because I don't see how else you are going to solve this problem other than by refusing to accept that much money.

There are other options too but, yes, if you want normal people to use cryptocurrency it needs to be as safe as the traditional banking system. Large transactions at a bank will get multiple identity verifications, time delays, trusted third parties handling multistage transactions where physical goods change hands or independent processes complete, etc. need to be tested and on by default because many people won’t think about it until it’s too late, as evidenced by all of the inadvertent 100M USD bug bounties by cryptocurrency companies.

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#495

Post by woah »

As usual on HN there are a lot of useless comments in this thread that are ill-informed dunks on cryptocurrency, but the real story of what happened is actually about the hazards of not using a blockchain.

The system that was compromised was a "proof of authority" chain. These are different from proof of work or proof of stake chains that have hundreds or thousands of distinct validators. In a "proof of authority" chain, a usually small number of nodes, often run by closely associated entities have control over the chain. This is not a trustless system, and it does not have the same security and decentralization aspects that people usually associate with a blockchain. I would argue that it is not different than a trusted third party custodying the money.

In this case, the system was especially egregiously abused in that 4 of the "validators" were actually controlled by the same entity. This then required the hacker to compromise only two systems to steal the money.

The hacker is guilty of theft, but Axie Infinity, in my opinion, is guilty of falsely advertising their system as a blockchain.

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#496

Post by Uehreka »

cinntaile wrote: post #466
warent wrote: post #451

Earlier quoted context omitted.

Hideous victim blaming mentality here.

I'm not blaming someone for getting scammed, that's on the scammer. But I am blaming someone for ruining their own life if they put more money into a speculative, highly risky asset than they can lose. This isn't confined to crypto, it can also be regular stocks or other investments. I mean this in a general sense. I don't mean people taking advantage of people that aren't in the right state of mind (for whatever rea…

When we raise concerns about crypto’s riskyness, people like you show up and say “investment involves risk” and frame crypto as a speculative investment. Then when you’re gone someone else will show up hyping Bitcoin/Ethereum as a currency that will change the world, which implies that it is or will be stable enough to use to pay for goods and services (as opposed to being a vehicle for speculation).

Our frustration stems from our inability to get both of you in the same room to duke it out once and for all.

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#497

Post by kache_ »

MrMan wrote: post #408
kache_ wrote: post #351

Earlier quoted context omitted.

not your keys, not your crypto :) your crypto won't get stolen if you have good opsec

ha ha opsec sounds so cool but its actually the opposite of civilization lol not your kek not your jejeje

Usually I'm on /g/ threads pretending to be hacker news, but this time the script got flipped :D

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#498

Post by the_gastropod »

gonehome wrote: post #329
the_gastropod wrote: post #306

Earlier quoted context omitted.

Hitting yourself in the head with a hammer might offer some benefits: - The cool metal might cool your head on a hot summer day - Might knock yourself unconscious to avoid boredom (could be real handy during long flights!) But these nice features are inseparable from the fact that you're hitting yourself in the head with a hammer, which has many serious downsides, too. The "improved self-custody" crypto offers is one…

This is a comparison dumb enough to basically be in bad faith. Ignoring that and focusing on the substance: > "The "improved self-custody" crypto offers is one side of the ledger. The other side is: you lose regulatory protection, and can be swindled with virtually zero repercussions." Yeah I don't disagree with this - the risks are real. Some of this can improve with better tools, but some is just higher risk that e…

> Not all governments are good and even good governments can implement bad policy.

Indeed! Many governments are truly awful. And it's a deeply complex problem to solve. The strategy of "screw it, let's just bypass the laws when I feel like it" is deeply troubling. And I think you needn't look further than the fact that so many despots have wholly embraced Bitcoin: Bukele, Putin, Kim Jong-un, Erdogan, Maduro, Assad, etc. Why do you suspect that is? Are they just clueless dummies who're getting fleeced by the Bitcoin pumper geniuses?

The problems with corrupt governments is the lack of accountability via regulation and legal redress. The solution is increasing accountability—often a difficult problem, no doubt. But advocating for crypto as the solution, is advocating for the harms done to people to be anonymized, and ultimately made unaccountable. That's a Very Bad Idea™.

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#499

Post by cinntaile »

mrmuagi wrote: post #483
cinntaile wrote: post #466

Earlier quoted context omitted.

I'm not blaming someone for getting scammed, that's on the scammer. But I am blaming someone for ruining their own life if they put more money into a speculative, highly risky asset than they can lose. This isn't confined to crypto, it can also be regular stocks or other investments. I mean this in a general sense. I don't mean people taking advantage of people that aren't in the right state of mind (for whatever rea…

Not sure why you got such a negative reaction. This is basic 101 holding a investment portfolio (I hope I have it right [1]), the more all in the upper right (higher std dev) of this graph, the higher risk, the more bananas you'll lose in your basket if things go, proverbially, tits up. Diversifying is a tool/shield against this by minimizing risk against reward. [1] https://youtu.be/8TJQhQ2GZ0Y?t=1640

Crypto is a touchy subject here, so if I am a bit harsh on the people that ruined their lives by putting all their eggs in one crypto basket... I was prepared for it not to go well. Although I think some misunderstood my comment as blaming the victim, which was not what I meant. But that's ok, I'll try to phrase it better next time.

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#500

Post by vmception »

woah wrote: post #495

As usual on HN there are a lot of useless comments in this thread that are ill-informed dunks on cryptocurrency, but the real story of what happened is actually about the hazards of not using a blockchain. The system that was compromised was a "proof of authority" chain. These are different from proof of work or proof of stake chains that have hundreds or thousands of distinct validators. In a "proof of authority" ch…

The consensus model of the database isn't relevant when the bridge contract itself was what signed off right?

Isn't the issue that the keys were just for signing that transaction for that contract?

Or did they really compromise 5 of 9 nodes for the entire blockchain? If it was this, it still doesn't suggest that was really necessary and only coincidence. It is just a fine to compromise funds on a centralized blockchain as long as you can get the funds over the bridge before the validators pay attention to block it, that's pretty common too. A flight to security.

Post reply on HN