39 ms·
$625M worth of ETH drained on Axie Infinity's Ronin Network
- colesantiago 5y agoThis wallet contains the $625M funds in what appears to be the largest crypto defi hack in history. https://etherscan.io/address/0x098b716b8aaf21512996dc57eb0615e2383e2f96 https://etherscan.io/address/0x098b716b8aaf21512996dc57eb061...
- Apocryphon 5y agoFor now. Cryptocurrency hacks are like EVE Online news, where there would be a story every few months about a massive heist totaling tens to hundreds of thousands of dollars of real-world currency, or yet another bigger battle that destroyed enough vessels equivalent to that amount. Just people outdoing themselves every time.
- swarnie 5y agoWasn't there another one in the billions a few weeks ago? The guy with the cringe rapper wife?
- CydeWeys 5y agoIt ended up being worth billions, but at the time of the back years ago, Bitcoin was much less valuable than it is now.
- lalaland1125 5y agoThat wasn't defi. That was a more traditional exchange hack.
- swarnie 5y agoIm not sure i understand the difference between various cryptoscams. Is that the one where people launder money by buying jpegs?
- salt-thrower 5y agoThe amount that was stolen in that case is worth billions now, but at the time of the theft it was only a couple million. It has since increased in value which led to the “billions” headlines.
- toyg 5y ago> The attacker used hacked private keys Why do people write "hacked" instead of "stolen"? To make it look like robbing them is harder than it actually is?
- cesaref 5y agoStolen has a very specific meaning, it involves taking something from someone else, denying them the ability to use it. If the person still has the thing, you've not stolen it. I think 'copied' is the right word here. They hacked the system, and copied the keys.
- ttoinou 5y agoStolen implies a concept of property. Which doesnt exists here....
- CydeWeys 5y agoWhat meaningful distinction is drawn by using one of these words over the other? "Hacked" typically implies it happened over the net, whereas "stolen" typically implies it physically happened in person. The former is more appropriate here, no?
- jsmith99 5y agoI like to distinguish attacks where money was stolen using stolen credentials from those that occured simply by manipulating smart contracts. Some crypto enthusiasts would consider the second type of attack to be legitimate activity rather than theft, so long as the attacker stayed within the letter of the 'law' as expressed on chain.
- fsckboy 5y agohacking a system and stealing a key (copying) is a lot less interesting than hacking a key by exploiting some cryptographic weakness
- bruce511 5y agoI'm not sure I agree. I mean secrets can be stolen. Apparently pirating music or movies is theft and so on. We've often seen the naritive of Big company stealing ideas etc from smaller companies. So stealing can extend beyond simple physical property, and could acceptably encompass IP as well.
- atty 5y ago> make sure all funds are recovered or reimbursed Does anyone know if they have the liquidity to actually reimburse over half a billion?
- rvz 5y agoSo close to April (greater) fools day. Who on earth is going to fill that $600M black hole? (No one.) Or is someone going to reverse the Ethereum blockchain this time? (No one. Not even Vitalik this time.) So I don't think there is anything going to save them from this hack.
- 3np 5y ago> The validator key scheme is set up to be decentralized so that it limits an attack vector such as this Even now, when it's obvious to everyone that only two parties needed to be compromised for this to happen (4/5 compromised nodes were effectively under one party it seems), they keep calling it "decentralized". Apart from the lack of gifs, memes and emojis in the post, I have a hard time coming up with a worse response.
- almalkemqq 5y ago
- outsb 5y agoOver half a billion in assets and.. > We discovered the attack this morning after a report from a user Fuck me.
- zaroth 5y agoSeriously. That was really really hard to read. So basically $600mm in a hot wallet and no one even watching it. Just wow. They didn’t even hack the smart contract, they just compromised 4 systems holding the private keys, and there was an RPC signing function giving free access to the 5th. Good god.
- mattbrewsbytes 5y agoSounds like if they had a checking account with their bank credentials stored in ENV variables and someone got access to that server it would be the same outcome. The details of it being on a crypto-currency are interesting but when password/passphrase/private key security is poor it doesn't really matter the medium holding the money.
- openasocket 5y agoAren't there methods of rolling back transactions in the traditional banking system though? And additional validations on larger volume transactions?
- mplewis 5y agoThat's right. None of these protections exist in their sidechain.
- mrits 5y agoIt would be much different outcome that would probably lead to recovering the money.
- oefrha 5y agoNo, $625M transfer out of a single bank account would raise tons of eyebrows. No way it’s authorized by some env vars.
- Stevvo 5y agoA 51% attack on a blockchain with a grand total of 9 nodes... why would be people trust such an obviously insecure chain with such large value?
- Dig1t 5y agoSo they now have this giant sum of money sitting in their wallet https://etherscan.io/address/0x098b716b8aaf21512996dc57eb0615e2383e2f96 https://etherscan.io/address/0x098b716b8aaf21512996dc57eb061... what do they do next? How do criminals even use this money to do anything?
- lalaland1125 5y agoGenerally, they can wash the currency, either through mixers or by routing through a privacy focused coin like Monero. Properly done, there is no direct connection between the new washed currency and the stolen assets.
- zaroth 5y agoThey could just burn it - it makes everyone else’s ETH more valuable. Or move it through decentralized tumblers. Which is why more and more these tokens are becoming non-fungible as addresses are blacklisted. Non-fungible is another way of saying centralized, by the way. The whole system is a house of cards. The final straw will be when quantum blows it wide open.
- jonathan-adly 5y agohttps://tornado.cash/ https://tornado.cash/ Probably can get $3-5m or so a year slowly. (which would take ~25 years or so).
- jandrese 5y agoWhich is what that horrible cringe rapper lady was doing when she and her boyfriend were busted.
- jonathan-adly 5y agoNo - they had Bitcoin, completely different beast. (due to lack of smart contracts, Bitcoin is a lot simpler/transparent/harder to hide stuff there).
- 5y ago
- adtac 5y agoThis probably sounds like an insanely dumb idea to crypto people, but is it absolutely infeasible to reverse transactions when there's consensus that it's a hack? The TX fees need not be reversed (consider it to be a small price to pay for being hacked). A little bit of centralisation could make the whole network safer. Who is that centralised authority to decide what's a hack, I hear you ask. I don't know, but the authority could be elected and impeachable to make it more democratic.
- RL_Quine 5y agoWhat is your threshold? Who decided what is "not legitimate" activity? Clearly in this case the money was spent using the keys that were allocated to be able to control the money, what process overrides that?
- arcticbull 5y agoI mean we have an answer to that, it's called the law, and its worked since 1750BC. [edit] This guy, Hammurabi - king of the First Babylonian Dynasty - faced a similar quandary, so there's some prior art. Disputes under the law are resolved in court.
- SketchySeaBeast 5y agoIsn't that anathema to the new world order the crypto people are espousing?
- horsawlarway 5y agoGenerally yes. As someone who has actually purchased real goods with bitcoin (silkroad) and has dealt with the blowback of the MtGox scandal (still receiving court details to this day...) Those crypto people are snake oil salesmen. Full fucking stop. They aren't interested in making anything usable, they're interested in wild speculation, gambling, and outright scams.
- gonehome 5y ago
- xiphias2 5y ago,, Originally, Sky Mavis chose the five out of nine threshold as some nodes didn’t catch up with the chain, or were stuck in syncing state’’ Sounds like a great plan for storing half billion dollars. I’m not blaming the developers, as they are incentivized to move fast and break things, I’m just sorry for all the people who trust new protocols so easily without any knowledge in safe software security practices. Personally I’m a Bitcoin only person, because I respect the amount of work that the software authors do to minimize the attack surface, but at the end the free market will select the winners and losers.
- jrm4 5y ago"I'm not blaming the developers.." I mean, I think it's time to put that on the table...
- 58x14 5y agoIf I was betting, I'd put my money on VC pressure.
- thegeomaster 5y agoI am blaming the developers. Perhaps this is not a popular view, but this "blameless" culture is fine and good when it's a random service going down for 15 minutes and you're trying to collaborate and prevent it from happening again. There must be limits though. If you're handling that amount of money in a bank and you fuck it up like this, your ass is on the line, together with the ones who incentivized you to move fast and break things. This should be no different.
- xiphias2 5y agoI have been to a few crypto meetups and seen people just talk about buying and selling tokens/cryptocurrencies without knowing more than the name of the currencies. They are betting on software in alpha phase without knowing anything about it, or any detail about the cryptography, concensus mechanism or coding practices they use. There are valid concerns with any asset where people want to store their wealth (which is at the same time a basic human need), but it's hard to reason with peope who are not interested in discussing those concerns.
- gzer0 5y agoThe blind leading the blind here in the wild, wild west of crypto.
- dpiers 5y agoI'm out of the loop and trying to understand - people lent over half a billion dollars of their 'real' fake money (ETH) to a game studio so they could transact on the studio's sidechain because gas fees are prohibitively expensive on ETH, and then the game studio got hacked and lost it all? How was this ever going to end any other way? Imagine how preposterous the idea of storing $650mm in USD in a random game studio's checking account would be.
- alanlammiman 5y agoCash app, Venmo, Wise, and hundreds of other payment apps are also this - perhaps a bit larger, more reputable, more regulated, but not fundamentally different (or am I missing something?)
- motoboi 5y agoYes. People worked hard for electronic dollars to be transferred to their electronic wallets. They tried to use some of that digital money (in another electronic format) in a digital game, but the game got hacked and now those dollars are someone’s else dollars. The hacker may have some difficulty transforming digital money into paper bills, because KYC, but he can launder it like old school people used to and have some.
- profmonocle 5y ago> but he can launder it like old school people used to and have some. Crypto provides exciting new ways to do that, too. First send it through a mixer service. Then, invest in some new NFT project. Six months later, oh nice, someone bought your NFT for 10x what you paid for it. What a great investment.
- gowld 5y agoSelling NFT for over >$1000 should trigger an investigation into provenance of the funds.
- joering2 5y agowhen it comes to banking, random checking accounts are hacked into very rarely. to the point that in USA the FDIC is protecting your account up to $250,000. I don't recall last time seeing news on someone's bank account being hacked and drained, if anything its mostly family fraud. also there are all sorts of checks when you try to wire or withdraw more than $10,000, not to mention wire hundreds of millions. Such transaction will manually cross a desk of at least 2 different bank managers.
- onebot 5y agoIt is amazing to me that these bridges can't figure out a reliable auditing mechanism. I can't wait to learn about how this was accomplished. But with the amount of money at risk, it seems like there has to be a mechanism to secure these things and maybe have a backstop in the even something does go wrong.
- px43 5y agoLots have bridges have figured out good auditing mechanisms, and have built in fail-safes, circuit breakers, daily limits, etc. Those aren't the ones in the news for getting hacked though.
- mabbo 5y agoIn a system run by people, the transaction could be reversed, traced, and the culprits eventually brought to justice. In a system run by algorithms, designed to avoid oversight by people (governments), there is no such powers. There's no reversal. There's no checking the name on the account the transfer was to. It's just gone. I do not understand why people who have legal intentions would want to be part of the crypto economy. There's nothing but more risks with zero benefits.
- malfist 5y agoArguably it's the same risk as holding paper notes right? If I steal your life savings from under your mattress, there isn't necessarily anything to trace it back to me. However, there is a physical limit, pretty damn hard to run off with half a billion worth of paper notes.
- paxys 5y agoIt isn't even just the limits of the notes themselves. Physical theft has to be done on location. You have to steal the money and get away as far as possible as quickly as possible. And there are local laws and police equipped to go after you. How do you deal with it when the money could be in the pockets of an Eastern European teenager with one script run?
- tomatowurst 5y agoparent is talking about the financial system run by algorithms designed to evade sanctions and regulation, not being your own bank. You absolutely can keep millions under your mattress and some do when they cannot launder it but it would be up to you to reverse the transaction in a forced wealth transfer vs the bank who can simply trace or even reverse a fraudulent transaction.
- mnumber 5y agoWhy did you equally conflate the risks then immediately back peddle and say "physically stealing is harder i guess"?
- 5y ago
- bob2222 5y agoHAHAHAHA. Good. Blockchain is for clowns
- jonathan-adly 5y agoI just finished reading The Cryptopians by Laura Shin. I am 100% convinced that this will be the rule of smart contracts (where a certain percentage will always be "hacked"). Structurally, smart contracts are very complex vehicles - and the financial reward to hack them is always higher than being a good player.
- shafyy 5y agoI love how crypto brodudes are all like "fuck the government, we want anonymity and no regulations", and the second their dumb system stops working and they lose all their gambling money, they come running back to the government. Fucking pathetic.
- munificent 5y agoPrivatize the profits and socialize the losses. Classic.
- intrasight 5y agoIt's all "decentralized" except where it counts.
- dave84 5y agoI'm so far outside the cryptocurrency scene that this reads like science fiction to me.
- red_admiral 5y agoEchoes of Mt Gox: when something meant to be a much smaller operation (such as a place to trade Magic:The Gathering cards) suddenly finds itself playing a much bigger game. It's like you agreed to temporarily store the Fort Knox gold reserves in your spare room, but still have the same ordinary lock on the front door.
- mhitza 5y ago> Fort Knox gold reserves in your spare room What do you mean a wooden safe isn't good enough?! Joke aside. This is the reality we live in. Almost makes heist movies pale in comparison. The failed Die Hard heist was planned in order to steal $640M. I wonder how long until Hollywood will start making movies about these hacks.
- babyshake 5y ago> I wonder how long until Hollywood will start making movies about these hacks. I'm guessing they would portray it as being in the "metaverse" so they get to actually show a physical heist happening. And yes, of course that's not even remotely how any of this works but that's never stopped Hollywood before.
- bombcar 5y agoThese hacks are boring, it's just code - the closest to making code look cool was perhaps the Matrix. Oceans 11 is interesting because what they're doing is explainable and interesting, running various commands in a console window isn't.
- rchaud 5y agoThere is a whole genre of teen thriller movies that play out entirely in the medium of messages sent back and forth on phone screens. It's exactly as exciting as you can imagine.
- imtringued 5y agoProbably about as exciting as stacking icons on ingame maps. https://youtu.be/W12zKDvHsQI https://youtu.be/W12zKDvHsQI
- ericjang 5y agoSupposing the hacker gets away with stealing such large quantities of stolen ETH without getting caught and their ETH is now sitting in a brand new wallet that everyone knows about. Is the next move to convert it into a privacy-preserving coin like Monero, then back to "clean" ETH? source: https://ethereum.stackexchange.com/questions/2699/is-there-any-ether-mixer-tumbler-available https://ethereum.stackexchange.com/questions/2699/is-there-a...
- arthurcolle 5y agotornado.cash
- anchpop 5y agowhat kind of volume does tornado.cash process? If it normally processes e.g. $1M/day, it'd take a while to use it as a mixer right?
- colinmhayes 5y agoWhat's the rush?
- Tepix 5y agohttps://dune.xyz/poma/tornado-cash_1 https://dune.xyz/poma/tornado-cash_1 Between 40 and 200 million per week.
- kache_ 5y agoOr you just keep it in monero indefinitely :)
- xur17 5y ago> Is the next move to convert it into a privacy-preserving coin like Monero, then back to "clean" ETH? I'm not sure there is enough liquidity in the Monero / ETH trading pairs to do something like that without being really obvious.
- lordnacho 5y agoSo how did they get the private keys? Wouldn't you make some sort of airgap system if you were securing most of a billion bucks?
- gen220 5y agoQuestion for the legal-minded folk here. Is this "theft" illegal in the criminal sense? It's exploiting an unintended hole in software, but it's technically following the smart contract faithfully, albeit against the better intentions of its author(s). Has a smart contract case like this been litigated before? It brings to mind comparable things that have happened in the financial services world, where one party insists on following a poorly-composed contract to the letter, to the detriment of their counter-party. Their actions were deemed unethical, but not criminally illegal.
- rafale 5y agoIn traditional courts? Yep, it's a crime because there is clear damage being done to the victims. As simple as that.
- shock-value 5y agoI'm not a lawyer. It appears that part of this heist involved hacked keys. That aspect would be straightforwardly illegal I would imagine.
- phphphphp 5y agothis wasn’t a smart contract exploit, it was a stolen keys exploit. Very different, flat out theft rather than exploiting “code is law” (and almost certainly an inside job).
- elif 5y agoThe attacker gained control of 5 validator nodes. This is as clearcut as hacking and theft charges can get.
- Jabbles 5y agoI don't believe this has been tested in the courts. But I don't see much difficulty in convincing a court that this fits the definition of theft in some jurisdictions. In the UK: "Theft is defined by section 1 of the 1968 Act as dishonestly appropriating property belonging to another with the intention of permanently depriving the other of it." A brief explanation of each of those terms is given, and I don't see any particular problems related to this being cryptocurrency. The point that "smart contracts allow what the code says and nothing else matters" does not fit with the dishonesty interpretation that "The owner would agree to their taking it if they knew about it". https://www.cps.gov.uk/legal-guidance/theft-act-offences https://www.cps.gov.uk/legal-guidance/theft-act-offences
- hinkley 5y agoSomething tells me that if indeed cryptocurrency sticks around it’s going to sprout rules and regulations that are a mix of banking and securities regulations, and that will suck most of the “fun” out of it. We pause the stock market on a 5% drop and stoop it on 10%. Moving that much crypto in a day is probably never on purpose. Though in a distributed consensus system I don’t know how you’d enforce such a thing.
- munificent 5y agoAnyone who knows anything about human systems knows that that's the end point: We'll be right back to banking as it is today, except with less efficiency and a ton of wasted time and technology that could have been spent making the current systems better.
- babyshake 5y agoThere's an analogy to be made with the internet and WWW. In some ways everything did revert from the early wild west days of the web to a small number of curated and censored walled gardens (Facebook, etc.) but it's not accurate at all to say that things reverted to a pre-internet status quo.
- munificent 5y agoI think you can understand a lot about a technology or system by who is hyped about it and when. Very early in the bitcoin days, cryptocurrencies were pretty interesting because it was nerds playing with a new kind of distributed systems computational tool. "Hey, here's a way to create widely available data without trust! Neat, what can we do with that?" But for the past several years, it's clear to me that the majority of people in crypto are excited about getting rich. They generally strike me as the exact same kind of people that would be prospecting in the Yukon in the 1800s. They don't care about geology in itself, they care about what they can sell the gold for. Ultimately, those kinds of people are exploiters and extractors. They may generate wealth and some of it may flow outwards to others, but I personally find that they do produce little that has any real meaning. The wealth they produce might coincidentally get used for something meaningful, but even that's a crapshoot. No one remembers the name of the dude who found the biggest gold ingot and that's likely for good reason. I don't think the early days of the web were similar. Yes, it was initially nerds and then there was a huge rush of people trying to get rich. But at least the ones trying to get rich were trying to get rich by making something useful to others. It felt less like a gold rush and more like the westward expansion. More farmers than miners. The web was a place to make new things and not simply a direct means to play financial games. The crypto bros—despite spinning up lots of businesses and coins and pretty websites with fancy logos—ultimately aren't out to make anything that touches anyone's lives. Imagine if one day all of the money disappeared from crypto and all promise of any future money evaporated. You could still do all the same crypto stuff, there was just no hope of making a dime. The whole system would collapse overnight. That's not true with the web. Sure, a lot of businesses wouldn't be able to afford to keep running, but many of the people making stuff on the web would do their best to keep making their stuff on the web, because it was more about the stuff itself than the money.
- rafale 5y agoIf I were the hacker, I would be waiting for an offer to return the money. Which Sky Mavis haven't done. I think 1% is reasonable.
- manquer 5y agoWhy won't they directly ask themselves? All these random ware hackers do.
- modeless 5y agoAnd they didn't notice for 6 days!
- JaimeThompson 5y agoIf only they had used a Web3 based solution this wouldn't have happened.
- mdanger007 5y ago"Maybe We Were Wrong About Be Wrong About Web3"
- rottencupcakes 5y agotl;dr: in what is supposed to be a decentralized system, 9 validator machines had the power to approve or deny transactions. 4 of these are owned by the same person and shared credentials, and 1 of these had its credentials stored on the aforementioned 4 because user load was bad once, so they just decided to use the other machine’s resources. In other words, hacking one validator gave a user full access to the system, because that gave them access to 5/9 validators which is a majority.
- oblib 5y agoI have not dug into the details of how this stuff works because every time I've looked for them what I found looked like bullshit. They all imply this stuff is so secure no one knows who's "money" it really is, and that's supposed to be a feature. I'm still not regretting not buying into this stuff.
- Loughla 5y ago>I'm still not regretting not buying into this stuff. I mean, I am 100% regretting spending 15 bitcoin in college on. Um. stuff instead of just sitting on it as a speculative tool. Other than that, I have had family approach me asking about crypto in general and BTC specifically in the last year. I always tell them - it's like gambling, except on top of maybe losing your money, somebody is going to try to steal it from you at some point as well, and there's no cops you can call.
- kache_ 5y agoWorking as intended! God I love crypto, it's the fuckin wild west out there If you don't want the government in your business, you're going to have to dispense with all the advantages that big daddy affords you
- mistrial9 5y agoyes, a deal between the parties, with all the risk and reward that goes with it.. really eye-opening to see all the comments wishing for an all-powerful referee to check every outcome and action in private affairs
- JumpCrisscross 5y ago> eye-opening to see all the comments wishing for an all-powerful referee to check every outcome and action in private affairs News flash: this is a part of why we have banking and securities regulations. Because when the people clamouring for an out lose money, 90% of them turn it into everyone else’s problem. (This is true in traditional finance. It’s true in crypto. It’s true when the three-year old screams about not being allowed the hot sauce and then screams when they taste it.) $625mm from Axie Infinity is tolerable to the system. But when Tether busts, do you really think it won’t become our elected governments’ problem?
- mistrial9 5y agoI have St Louis Federal Reserve reports right here on my desk showing the ballooning USD money supply. "News Flash" means the person you are talking at, has never heard of this.. so News Flash elsewhere This article has nothing to do with "Tether" .. a soapbox somewhere is lonely
- kache_ 5y agoI'm actually not wishing for a powerful referee - I'm _happy_ this hack happened. It means that cryptocurrency as an experiment succeeded in completely removing centralized control, and we're now closer to my libertarian utopia enabled through technology
- ozten 5y ago"We are working with law enforcement officials..." If the promise of ETH contracts is that code is law and to eliminate needing trust, then how and why would law enforcement get involved? Did the attackers break down the door and steal the money? Or did the provide a widget that met the contract and which just happened to have the unfortunate side-effect of siphoning off tokens, a bug which will be fixed in the next revision of the contract... I 100% agree this behavior is immoral, but as web3 coders become essentially lawyers, is it illegal? The further we go from fiat currency, are we burdening a specific countries tax-funded investigation and enforcement? Fascinating stuff!
- renewiltord 5y agoIt's in the article. Keys were stolen.
- ozten 5y agoThank you, I missed that detail. I do think the larger question of DAOs replacing trust with code/law is worth further discussion.
- tcgv 5y agoAfter following the DeFi space for over a year now I've come to the conclusiong that "code is law" is a fallacy. If you come to the possession of funds that were not intended to be in your possession by exployting bugs or vulnerabilities, and other parties are significantly harmed in this process, then you will be in a position to face criminal charges... Well that is unless one can maintain anonymity indefinitely. Once anonymity is lost law enforcement may come for you. The best thing you can do (and the moral thing to do) is to submit for a bug bounty in case you find a crictical bug in a blockchain/protocol.
- jazzyjackson 5y agoFunny that it's kind of the same paradox as robbing a bank the old fashioned away. Congrats, you have millions of dollars of cash, good luck spending it without anyone asking "hey where'd you get all this money" / bragging to a friend
- peterweyand0 5y agoSo, if someone could explain this to me, I don't understand all the particulars. From the article - The attacker used hacked private keys in order to forge fake withdrawals. The validator key scheme is set up to be decentralized so that it limits an attack vector, similar to this one, but the attacker found a backdoor through our gas-free RPC node, which they abused to get the signature for the Axie DAO validator. Can someone explain what happened here? How were they storing the keys in such a way that they were accessible from the internet? Namely, is this a problem with how crypto is designed itself, did they mishandle their architecture (so presumably if they organized their containers in another way then a hacker wouldn't have access), or did they just put the keys in a file that said KEYS.pem with open access? Does this have implications for blockchain as a whole or was this company just dumb? Ideally, you shouldn't hold 650 million in one wallet, but if the promise of crypto is supposed to be secure then it shouldn't matter. PS: If anyone would loan me 650 million dollars I promise not to lose it and would take only a small percentage of the total to pay rent and continue to exist.
- paxys 5y ago> How were they storing the keys in such a way that they were accessible from the internet It's almost always either phishing or insider help.
- Sargos 5y ago>Does this have implications for blockchain as a whole or was this company just dumb? They were just dumb. The Ronin bridge where this money was stolen from wasn't decentralized at all and wouldn't even be recognized as a blockchain by even moderately experienced user. It was just a 5 of 9 multi-sig where the security was very poor and susceptible to social engineering. This was akin to a company keeping 100 gold bars in the closet by the bathroom and doesn't say anything about technology or things like DeFi or smart contracts.
- xur17 5y ago> It was just a 5 of 9 multi-sig where the security was very poor and susceptible to social engineering. Taking this a step further, the article mentioned that 4 of the 5 were under one companies control and compromised together. It wouldn't shock me to learn that all 4 had the same access rules, and as such all were accessible if one was, essentially reducing the 5 of 9 to 2 of 9.
- Animats 5y agoSuspect an inside job. Axie Infinity is a Ponzi scheme in the collapse stage. Looks like they found an exit strategy so they can blame someone else.
- cobrabyte 5y ago> All of the AXS, RON, and SLP on Ronin are safe right now. Of course they are. They're worthless.
- apeace 5y agoCan someone attempt to explain or speculate at what the attacker is doing with their wallet right now? https://etherscan.io/txs?a=0x098b716b8aaf21512996dc57eb0615e2383e2f96 https://etherscan.io/txs?a=0x098b716b8aaf21512996dc57eb0615e... As I write this at about 17:00 UTC, they seem to be doing lots of small transactions (about $1 USD), and they are coming "From" many different places, but only showing "To" the "Ronin Bridge Exploiter". I don't understand this stuff well enough to see what it is they're doing, but I'm curious. I'd imagine they're working diligently to secure their rather large fortune...
- Jerrrry 5y agoIt will be laundered in millions of $1 transactions, with others that are doing the same. Then it will be sold at a discount for Monero or a shitcoin, and then theyll get a couple thousand dollars in cash in the mail for the rest of their life. im jealous at this point,
- vmception 5y agoNo they’ll add some liquidity to Tornado cash And then a bunch of other large hacks will notice that Tornado cash is big enough to handle their large amounts too, adding more liquidity to Tornado cash And then some FAANG engineer is going to take their clean $50k paycheck and buy into a new launched token on Uniswap And that token is going to rally 100x because the tornado cash withdrawals keep buying that token And then that engineer is going to sell the tokens into the Uniswap liquidity pool, transfer the Ether to dollars, and report capital gains as just another lucky crypto trader You’re welcome
- bogota 5y ago
- IE6 5y agoAnecdotally, I see this response to criticism of crypt pretty often: that we just don't understand. If you wanted to help a non-believer understand where would you point them? Not interested in being red-pilled into s**-coins but rather understand the benefits better. All of the sources I frequent are quite critical of the actual benefits (if any) of crypto.
- erdeszt 5y ago> We are working directly with various government agencies to ensure the criminals get brought to justice. It's amusing to see these kind of statements from the decentralized no goverment/no authorities crowd. To quote RKL: Well it's anarchy, fuck the cops Of course, how else, through peace. But when the looters come to kick your ass I bet you cry "Police!"
- vmception 5y ago> It's amusing to see these kind of statements from the decentralized no goverment/no authorities crowd I see this meme and I don't get it Why do you think this studio was a no government no authorities crowd? I havent seen anything from Axie or its founders that suggested that, my assumption is that you see one word or one piece of technology that overlaps with the aspirations of completely different people that are anarchists, whats your assumption?
- Miner49er 5y agoWhat other value is there in cryptocurrency over traditional money?
- vmception 5y ago> What other value is there in cryptocurrency over traditional money? Collecting a bunch of it and using it like traditional money including earning more of it as well as converting it to traditional money simply because this market sector is hot and you can make a lot of money Focus on what you can control, there is zero need to adopt ideology to use it, and there is zero need to project your thoughts on it to rationalize sticking with less lucrative things
- Jxl180 5y agoTraditional money as in cash? Mailing cash to someone on the other side of the world is not ideal. Trusting PayPal or Stripe to not arbitrarily freeze your account because they think you’re making too much money too quickly is not ideal. Having to show ID to send or receive a money order is not ideal. That doesn’t mean I don’t condone the government prosecuting thieves who steal crypto.
- deleted 5y ago[deleted]
- sonnyblarney 5y ago
- holoduke 5y agoI think begind 95% of all crypto related products. Coins, Blockchain products etc is someone or something with only one goal. Collecting money and run away. To me the trust level is at the lowest ever.
- vmception 5y agoNoticed 6 days later lol
- paulsutter 5y agoCrypto has the biggest bug bounties
- outside1234 5y agoAre we going to regulate this insanity yet?
- schemescape 5y agoDoes “gas-free RPC” mean just a regular non-blockchain endpoint?
- michaelmarkell 5y agoNo, In Ronin for a while there was no ether (they wanted free transactions) so they had a special rpc endpoint that could accept “free” transactions with gas priced at 0. They still process 4/9 of the transactions on ronin even though they introduced a paid gas now — RON
- paulpauper 5y agoThis is possible bullish because it takes this ETH out of circulation. Very hard for hackers to sell so much hot eth. Likely it will sit dormant in wallets for a long time, maybe forever. It may never hit an exchange.
- tlb 5y agooof-size:large.gif To pick up one thread: how would increasing the consensus threshold from 5/9 to 8/9 help? It seems like the nodes were compromised with the same hack, so at most it's adding a little extra busywork for the attackers. But maybe there's a detail I don't understand.
- cjg 5y agoAnd then when two of the nodes die at the same time...?
- Barrera 5y agoThis is the kind of pain that comes from trusting scammers and nincompoops about unworkable blockchain "scalability" fixes. Here's the sequence. Those dumb enough to ignore it are doomed to repeat the pattern. I'm probably getting some details wrong in this Rube Goldberg scheme, so feel free to correct. 1. Citing "Ethereum network congestion," Axie Infinity announces an ethereum side chain, Ronin.[1] 2. Ronin was a centralized server (therefore fast and cheap) authorized to make Ethereum Mainnet transactions. The server was a hot wallet in other words. 3. The Ronin team tried to make it look like they were "decentralized" by splitting signing authority among 9 "validator nodes." (the article) 4. An attacker obtained 5 of 9 keys, which is the signing threshold. 5. With the required threshold of keys, the attacker signed the transitions moving assets off the Ronin servers. None of this is new. The Bitcoin "block size war" was fought over this very point. Unworkable scaling schemes are going to end in disaster with no fallback, and no recourse for those who lose money. You end up with nothing, and will be sad. And it's sad that the same lessons keep getting replayed over and over. It's really simple. Can your "blockchain" be validated with regular hardware? Does it use a secure consensus algorithm? Is there a secure side channel through which low-value transactions can flow? If not, you're going to have a bad time when the shenanigans start happening. Now, is that side channel effectively a single server? Handling hundreds of millions of dollars of value? Have they rolled their own crypto? If yes to any of these, get out and stay out. [1] https://medium.com/axie-infinity/introducing-ronin-axie-infinitys-ethereum-sidechain-8745e31eaef1 https://medium.com/axie-infinity/introducing-ronin-axie-infi...
- anchpop 5y agoRight now they're immature, but I'm hopeful that advancements in ZK-tech will allow practical ZK-rollups. ZKSync already has a zk-evm testnet running (which I believe is based on zk-llvm), so we're close. Currently all the big rollups have master keys which can be used to steal all the money deposited by them, but there's no reason in principle they have to have this. Polygon has permissionless rollups, so I'm quite hopeful that they'll be a viable trustless permissionless scaling solution soon.
- ethbr0 5y agoFor those who don't follow blockchain tech, like me, here's a primer on ZK-rollups: https://learn.bybit.com/blockchain/zk-rollups-eth-scalability/ https://learn.bybit.com/blockchain/zk-rollups-eth-scalabilit...
- paxys 5y agoThere are 25 comments on that blog post and half of them are links to crypto scams
- quantum-crt 5y agoWhat if they transfer the funds to the address of a random person. Imagine being that guy.
- vivegi 5y ago5 of 9 validator nodes? The Byzantine Generals Problem Leslie Lamport, Robert Shostak, and Marshall Pease (1982) ACM Transactions on Programming Languages and Systems, Vol. 4, No. 3, July 1982, Pages 382-401 https://lamport.azurewebsites.net/pubs/byz.pdf https://lamport.azurewebsites.net/pubs/byz.pdf From the abstract: ... It is shown that, using only oral messages, this problem is solvable if and only if more than two-thirds of the generals are loyal; so a single traitor can confound two loyal generals. With unforgeable written messages, the problem is solvable for any number of generals and possible traitors. ... Clearly this hack (and other prior crypto hacks) demonstrates that the 'Unforgeability' condition is practically impossible due to security implementation weaknesses. One can never rule that out entirely. That leaves no less than 2/3rds of the network as the bare minimum for reasonable consensus. Lamport's paper is from 40 years ago and blockchains/systems that ignore these theoretical foundations are doomed to repeat the same flaws again and again!
- demux 5y agoI was thinking how secure DApps built on Cosmos [0] would be. But I guess no matter the theoretical soundness, your DApp's security is as good as your L2 code. And messing around with L1s with no proper security foundation is a recipe for disaster. Re cosmos, if you guys aren't aware it's based on Tendermint [1] which is an advance in the field of consensus. [0] https://cosmos.network/ https://cosmos.network/ [1] https://tendermint.com/ https://tendermint.com/
- qeternity 5y agoThis is not a Byzantine fault problem. Consensus was achieved as designed. It was just the "wrong" consensus.
- danso 5y agoI'm not well read up on how sidechains work, but they're effectively as public and transparent as the main blockchains themselves, right? So anyone, particularly Axie themselves, could/should have a live dashboard reporting out their holdings. And the fact that it took 6 days for this to be noticed (and even then, only by accident) means they didn't bother having this metric be readily visible? (nevermind not having triggers to go off when a lot of funds are suddenly withdrawn for any reason)
- ceva 5y agoNothing new .. more pls
- mring33621 5y agoWhile I'm usually quick to judge crypto hacks/losses as "play stupid games, win stupid prizes," I am impressed, based on a quick reading, with the tone and content of this "Community Alert". They sound professional in what's no doubt a very stressful situation. Good Luck, Ronin!
- mdoms 5y ago> We are working with law enforcement officials, forensic cryptographers, and our investors to make sure all funds are recovered or reimbursed. All of the AXS, RON, and SLP on Ronin are safe right now. In which crypto bros once again discover that centralised authorities are not entirely redundant.
- deleted 5y ago[deleted]
- newuser33441890 5y ago
- newuser33441890 5y ago
- lykahb 5y agoAaand it's gone.
- coolspot 5y agoShoutout to A16Z for investment into Axie Infinity.
- deleted 5y ago[deleted]
- smoyer 5y agoWith each of these breaches, we're approaching a point where all coins will be considered tainted. When that happens do we jump into a different crypto-currency? It's also interesting that stolen coins are really hard to spend - more analysis seems possible as law enforcement learns how these systems work. What if a criminal shorted a coin, breached the system causing a giant loss and then profited from the short sell (and never touched the stolen coins?)
- woah 5y agoAs usual on HN there are a lot of useless comments in this thread that are ill-informed dunks on cryptocurrency, but the real story of what happened is actually about the hazards of not using a blockchain. The system that was compromised was a "proof of authority" chain. These are different from proof of work or proof of stake chains that have hundreds or thousands of distinct validators. In a "proof of authority" chain, a usually small number of nodes, often run by closely associated entities have control over the chain. This is not a trustless system, and it does not have the same security and decentralization aspects that people usually associate with a blockchain. I would argue that it is not different than a trusted third party custodying the money. In this case, the system was especially egregiously abused in that 4 of the "validators" were actually controlled by the same entity. This then required the hacker to compromise only two systems to steal the money. The hacker is guilty of theft, but Axie Infinity, in my opinion, is guilty of falsely advertising their system as a blockchain.
- vmception 5y agoThe consensus model of the database isn't relevant when the bridge contract itself was what signed off right? Isn't the issue that the keys were just for signing that transaction for that contract? Or did they really compromise 5 of 9 nodes for the entire blockchain? If it was this, it still doesn't suggest that was really necessary and only coincidence. It is just a fine to compromise funds on a centralized blockchain as long as you can get the funds over the bridge before the validators pay attention to block it, that's pretty common too. A flight to security.
- woah 5y agoIt sounds like the component that was compromised was a bridge controlled by the same validators. I'm glossing over the different components of the system for simplicity.
- iskander 5y agoThe security practice here is even worse than what you're describing, the company servers had been authorized to sign on behalf of the DAO, so only one compromise was required to get 5/9 validators.
- ricardobeat 5y ago> The Axie DAO allowlisted Sky Mavis to sign various transactions on its behalf. This was discontinued in December 2021, but the allowlist access was not revoked. Repeat with me: "decentralized"
- erdos4d 5y agoHow does one get hold of $625 million in ETH in the first place? The sums that usually accompany these hacks are astounding.
- rib3ye 5y agoIs this attack still happening?? atm, I see a pending incoming transaction to the attacker's address. https://etherscan.io/address/0x098b716b8aaf21512996dc57eb0615e2383e2f96 https://etherscan.io/address/0x098b716b8aaf21512996dc57eb061...
- qeternity 5y ago> incoming transaction You answered your own question
- deleted 5y ago[deleted]
- darth_avocado 5y ago9 validators is decentralized?
- adam_arthur 5y agoImagine a monetary system where a single hack or invention could destabilize and destroy the entire thing. An innovation indeed!
- JanDietch 5y ago
- simne 5y agoThis remembers me old history of fail redundant space computers, which appearing first lead to less failures, but in some short time things got much worse, because people give up on software reliability. Most expensive documented example - failed first launch of Ariane-5, where it's 3 fail redundant computers all stopped to work on same exception - costs 1 billion Euros. Used inherited software from Ariane-4, which is just have too much different design, so in some flight modes Ariane-5 could achieve much higher speeds than Ariane-4. And over time these things where written in Ariane-4 software as constraints and trigger exception if reached. So it was not the question, how redundant where computers and how many computers working in parallel as hot replacement - even if where 100s, all will become non working.