Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

$625M worth of ETH drained on Axie Infinity's Ronin Network

roninblockchain.substack.com

Post reply on HN
Print view View original

501–510 of 761 posts

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#501

Post by nwiswell »

easrng wrote: post #477
anchpop wrote: post #436

Earlier quoted context omitted.

In this case, the weakness was that the keys that controlled the bridge were somehow stored insecurely. When attackers gained access to the keys, they were able to steal from the bridge. In a properly-implemented rollup, there are no keys to secure, so this attack vector is ruled out. But more broadly, there is really nothing else with the same security properties as a smart-contract-enabled cryptocurrency. Paypal wi…

You are misinformed. With most cryptocurrencies (except Monero) it is very easy to blacklist wallets, and since tx history is public you can't just move your coins to a new address to get around it either. You don't actually even need decentralized systems for private transactions, digicash with blind signatures would be private and vastly more efficient.

I think "very easy" is relative. How do you get the whole world to agree to participate in the blacklist (or even to be aware of it)? If you don't, then obviously it will remain possible to tumble/launder the coins.

By comparison, if PayPal decides to freeze your account, that's it, the end, those funds are frozen unless and until you successfully run the corporate supplication gauntlet.

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#502

Post by WesleyHale »

xiphias2 wrote: post #355
thegeomaster wrote: post #130

Earlier quoted context omitted.

I am blaming the developers. Perhaps this is not a popular view, but this "blameless" culture is fine and good when it's a random service going down for 15 minutes and you're trying to collaborate and prevent it from happening again. There must be limits though. If you're handling that amount of money in a bank and you fuck it up like this, your ass is on the line, together with the ones who incentivized you to move…

I have been to a few crypto meetups and seen people just talk about buying and selling tokens/cryptocurrencies without knowing more than the name of the currencies. They are betting on software in alpha phase without knowing anything about it, or any detail about the cryptography, concensus mechanism or coding practices they use. There are valid concerns with any asset where people want to store their wealth (which i…

I'm not surprised since a large percentage of crypto buyers are millennials that grew up during the great meme boom of the 2000's.

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#503

Post by easrng »

vmception wrote: post #216
Jerrrry wrote: post #167

Earlier quoted context omitted.

It will be laundered in millions of $1 transactions, with others that are doing the same. Then it will be sold at a discount for Monero or a shitcoin, and then theyll get a couple thousand dollars in cash in the mail for the rest of their life. im jealous at this point,

No they’ll add some liquidity to Tornado cash And then a bunch of other large hacks will notice that Tornado cash is big enough to handle their large amounts too, adding more liquidity to Tornado cash And then some FAANG engineer is going to take their clean $50k paycheck and buy into a new launched token on Uniswap And that token is going to rally 100x because the tornado cash withdrawals keep buying that token And…

The thing is, they didn't. If you check the tx history most of it went to Huobi and some to FTX and Crypto.com

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#504

Post by woah »

vmception wrote: post #500
woah wrote: post #495

As usual on HN there are a lot of useless comments in this thread that are ill-informed dunks on cryptocurrency, but the real story of what happened is actually about the hazards of not using a blockchain. The system that was compromised was a "proof of authority" chain. These are different from proof of work or proof of stake chains that have hundreds or thousands of distinct validators. In a "proof of authority" ch…

The consensus model of the database isn't relevant when the bridge contract itself was what signed off right? Isn't the issue that the keys were just for signing that transaction for that contract? Or did they really compromise 5 of 9 nodes for the entire blockchain? If it was this, it still doesn't suggest that was really necessary and only coincidence. It is just a fine to compromise funds on a centralized blockcha…

It sounds like the component that was compromised was a bridge controlled by the same validators. I'm glossing over the different components of the system for simplicity.

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#505

Post by viksit »

Barrera wrote: post #225

This is the kind of pain that comes from trusting scammers and nincompoops about unworkable blockchain "scalability" fixes. Here's the sequence. Those dumb enough to ignore it are doomed to repeat the pattern. I'm probably getting some details wrong in this Rube Goldberg scheme, so feel free to correct. 1. Citing "Ethereum network congestion," Axie Infinity announces an ethereum side chain, Ronin.[1] 2. Ronin was a c…

curious - “can your blockchain be validated with regular hardware” - why is this a point you call out?

is it that specialized equipment is not easily accessible and thus not truly decentralized?

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#506

Post by acdha »

noasaservice wrote: post #107
arcticbull wrote: post #32

Earlier quoted context omitted.

I mean we have an answer to that, it's called the law, and its worked since 1750BC. [edit] This guy, Hammurabi - king of the First Babylonian Dynasty - faced a similar quandary, so there's some prior art. Disputes under the law are resolved in court.

Hammurabi's laws only work when they have a monopoly on violence to enforce said laws. Shitcoins (all of them) remove the potential of violence as a means of corrective action. Instead, you have crazy hard math stopping you. Can't do the math? Then you're not forcing your decision.

Think about this a bit more: I steal your cryptocurrency. When the police show up at my door and I say “you’d have to solve an impossible math problem to get it back!” do they a) threaten beat me and/or my family (Russia, China, etc.), b) shoot my dog and put me in jail where they look the other way while other inmates beat me (U.S. version), or c) toss me in jail (best-case Scandinavian version) until I tell them the key? There isn’t any case where they say “math is hard, guess you get away with it!”

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#507

Post by cinntaile »

Uehreka wrote: post #496
cinntaile wrote: post #466

Earlier quoted context omitted.

I'm not blaming someone for getting scammed, that's on the scammer. But I am blaming someone for ruining their own life if they put more money into a speculative, highly risky asset than they can lose. This isn't confined to crypto, it can also be regular stocks or other investments. I mean this in a general sense. I don't mean people taking advantage of people that aren't in the right state of mind (for whatever rea…

When we raise concerns about crypto’s riskyness, people like you show up and say “investment involves risk” and frame crypto as a speculative investment. Then when you’re gone someone else will show up hyping Bitcoin/Ethereum as a currency that will change the world, which implies that it is or will be stable enough to use to pay for goods and services (as opposed to being a vehicle for speculation). Our frustration…

> Our frustration stems from our inability to get both of you in the same room to duke it out once and for all.

If only the world were such a simple place where there is only one right and one wrong answer.

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#508

Post by [deleted] »

henriquecm8 wrote: post #282
zaroth wrote: post #23

Earlier quoted context omitted.

Seriously. That was really really hard to read. So basically $600mm in a hot wallet and no one even watching it. Just wow. They didn’t even hack the smart contract, they just compromised 4 systems holding the private keys, and there was an RPC signing function giving free access to the 5th. Good god.

> they just compromised 4 systems holding the private keys, and there was an RPC signing function giving free access to the 5th. This seems like the plot of a 90's hacker movie.

[deleted]

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#509

Post by allturtles »

mrmuagi wrote: post #476
saboot wrote: post #458

Earlier quoted context omitted.

You are neglecting to mention the great upsides in crypto currency. * Giving criminals and scammers the ability to exchange goods and services anonymously. * Providing a source of funding North Korea's nuclear weapons program * Allowing nation states to engage in global commerce despite sanctions because they won't stop killing innocent people * Convincing older and gullible people to give their money to someone they…

>* Giving criminals and scammers the ability to exchange goods and services anonymously. I don't see how this is any different than the bog standard "encryption lets criminals and scammers the ability to exchange goods and services anonymously.". Should money/txns be fundamentally track-able/examinable/un-encrypted but your private data/messages not? Surely this contention is something you also consider -- care to ex…

> I don't see how this is any different than the bog standard "encryption lets criminals and scammers the ability to exchange goods and services anonymously."

The obvious difference is that encryption has many, many actually useful and productive applications.

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#510

Post by asdfasgasdgasdg »

px43 wrote: post #157
asdfasgasdgasdg wrote: post #137

Earlier quoted context omitted.

Yes, but it's an open question how successfully and how frequently they catch the bad guys.

It's only an open question to people who haven't actually looked into it. Yeah, criminals get caught trying to move around stolen cryptocurrencies all the time.

Out of, say, the last ten big DeFi hacks, in what fraction have the perpetrators been caught?

https://decrypt.co/93874/11-biggest-defi-hacks-heists

I looked up the first six (#11-#6) projects on this list and I didn't see that in any of those cases the perpetrators have been caught nor the funds returned. I could be missing something though.

Post reply on HN