$625M worth of ETH drained on Axie Infinity's Ronin Network • Hacker News Board

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#141

Post by rootusrootus » Tue, Mar 29, 2022, 5:03 PM UTC

joering2 wrote: post #60

dpiers wrote: post #31

I'm out of the loop and trying to understand - people lent over half a billion dollars of their 'real' fake money (ETH) to a game studio so they could transact on the studio's sidechain because gas fees are prohibitively expensive on ETH, and then the game studio got hacked and lost it all? How was this ever going to end any other way? Imagine how preposterous the idea of storing $650mm in USD in a random game studio…

when it comes to banking, random checking accounts are hacked into very rarely. to the point that in USA the FDIC is protecting your account up to $250,000. I don't recall last time seeing news on someone's bank account being hacked and drained, if anything its mostly family fraud. also there are all sorts of checks when you try to wire or withdraw more than $10,000, not to mention wire hundreds of millions. Such tra…

> I don't recall last time seeing news on someone's bank account being hacked and drained, if anything its mostly family fraud.

Anecdote time. My wife and I have a shared checking account that got hacked and drained. First her debit card got skimmed. Then the perp called USAA a half dozen times claiming to be her and asking for account credentials. Finally they got a helpful account rep to reset the password, disable MFA, and tell them the username. Yep. You heard that right. Social engineering works even on bank tellers who should know better.

Fortunately it's just a daily use account and I'm paranoid, so there was only 5K they could access there. USAA owned up to the whole thing and restored the funds, but now they punish my wife with a 10-minute interrogation to prove her identity if she ever has to get them on the phone for a legitimate reason.

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#142

Post by lolinder » Tue, Mar 29, 2022, 5:03 PM UTC

whatshisface wrote: post #120

paxys wrote: post #88

Earlier quoted context omitted.

Giving $650mm in USD to a random company is still infinitely safer than doing so with crypto. If a regulated bank claims they got hacked and lost that amount, there are a slew of federal and state laws and agencies in place to investigate it. With crypto, it could very well be in the wallet of the CEO or IT guy and no one would know.

Cryptocurrency theft is illegal and the US government does investigate and prosecute it. [0] https://www.theguardian.com/law/2022/feb/14/us-bitcoin-case-...

That's all well and good when the thieves are in the US or a country that will extradite them. What happens when the thieves are operating out of a country without an extradition treaty?

In the regular financial world you can at least reverse the transaction. With crypto, is there anything you can do?

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#143

Post by leifg » Tue, Mar 29, 2022, 5:03 PM UTC

Dig1t wrote: post #20

So they now have this giant sum of money sitting in their wallet https://etherscan.io/address/0x098b716b8aaf21512996dc57eb061... what do they do next? How do criminals even use this money to do anything?

I had multiple arguments around situations like this.

There are essentially two camps. The one side says:

- You can sell for cash, use mixers, NFT sales, $other_sophisitacted_technology and get away with it

The other side argues:

- You won't be able to ever cash out this sum and law enforcement will use sophisticated data mining on the blockchain and will eventually bust you

I think in reality it is like any illicit asset worth $650 Mio. It's gonna be extremely hard to launder but not impossible.

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#144

Post by parkingrift » Tue, Mar 29, 2022, 5:03 PM UTC

UncleMeat wrote: post #92

RL_Quine wrote: post #33

Earlier quoted context omitted.

No monitoring whatsoever over $600M of funds stored in your system is crazy negligent.

It isn't like monitoring would have done anything. Once the transaction goes out it is gone. The core problem here is the massive private-key bounty being created by a ton of organizations that don't have world-class security teams.

True, but you would think they’d notice $650,000,000 missing before a user reported an issue withdrawing $5,000 (edit - 5k ETH). It’s honestly so impossible to believe that I’d wager the real story is they knew and were actively trying to recover the funds.

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#145

Post by weare138 » Tue, Mar 29, 2022, 5:04 PM UTC

UncleMeat wrote: post #92

RL_Quine wrote: post #33

Earlier quoted context omitted.

No monitoring whatsoever over $600M of funds stored in your system is crazy negligent.

It isn't like monitoring would have done anything. Once the transaction goes out it is gone. The core problem here is the massive private-key bounty being created by a ton of organizations that don't have world-class security teams.

But the attacker used 2 transactions. The first one should have been flagged immediately. Plus the servers themselves were compromised. Four of them. The attacker was able to take control of 4 different servers without even being noticed. This is just one massive secops fail.

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#146

Post by tormock » Tue, Mar 29, 2022, 5:04 PM UTC

granzymes wrote: post #84

radicaldreamer wrote: post #65

Earlier quoted context omitted.

The chance of $650 million being drained from a game studio’s bank account is significantly less than it being drained from their ETH wallets, at least as of now.

And if it was drained from a bank account, you have recourses to get it back.

You aren't insured for $650M in a bank account

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#147

Post by paxys » Tue, Mar 29, 2022, 5:04 PM UTC

peterweyand0 wrote: post #136

So, if someone could explain this to me, I don't understand all the particulars. From the article - The attacker used hacked private keys in order to forge fake withdrawals. The validator key scheme is set up to be decentralized so that it limits an attack vector, similar to this one, but the attacker found a backdoor through our gas-free RPC node, which they abused to get the signature for the Axie DAO validator. Ca…

> How were they storing the keys in such a way that they were accessible from the internet

It's almost always either phishing or insider help.

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#148

Post by trompetenaccoun » Tue, Mar 29, 2022, 5:04 PM UTC

gonehome wrote: post #50

shakezula wrote: post #30

Earlier quoted context omitted.

You’re describing a hard fork - exactly what created Ethereum and Ethereum Classic after the DAO hack. Even now it’s still considered a controversial move.

I think the majority sided with the move (which is why Ethereum soldiers on and EC is basically useless). It's a good final social check on bad behavior. I think Vitalik as written about this (I'm pretty sure I read about it in one of his long form posts).

He's also written this, basically warning about something like the very situation now happening 2 months ago: reddit.com/r/ethereum/comments/rwojtk/ama_we_are_the_efs_research_team_pt_7_07_january/hrngyk8

The DAO "hack" was a bit different from this, around 14% of all Ether were in that contract. There isn't going to be another rollback, especially not for something like the here discussed attack. Trusting third parties is risky. It's like taking your money out of your bank account and sending it to a bank in Nigeria. Things can go wrong, the chain can't be rolled back every time someone loses money. People have to be more careful.

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#149

Post by oefrha » Tue, Mar 29, 2022, 5:04 PM UTC

mattbrewsbytes wrote: post #99

zaroth wrote: post #23

Earlier quoted context omitted.

Seriously. That was really really hard to read. So basically $600mm in a hot wallet and no one even watching it. Just wow. They didn’t even hack the smart contract, they just compromised 4 systems holding the private keys, and there was an RPC signing function giving free access to the 5th. Good god.

Sounds like if they had a checking account with their bank credentials stored in ENV variables and someone got access to that server it would be the same outcome. The details of it being on a crypto-currency are interesting but when password/passphrase/private key security is poor it doesn't really matter the medium holding the money.

No, $625M transfer out of a single bank account would raise tons of eyebrows. No way it’s authorized by some env vars.

Re: $625M worth of ETH drained on Axie Infinity's Ronin Network

#150

Post by apeace » Tue, Mar 29, 2022, 5:04 PM UTC

Can someone attempt to explain or speculate at what the attacker is doing with their wallet right now?

https://etherscan.io/txs?a=0x098b716b8aaf21512996dc57eb0615e...

As I write this at about 17:00 UTC, they seem to be doing lots of small transactions (about $1 USD), and they are coming "From" many different places, but only showing "To" the "Ronin Bridge Exploiter".

I don't understand this stuff well enough to see what it is they're doing, but I'm curious. I'd imagine they're working diligently to secure their rather large fortune...