6 ms·

The FBI has tied the recent Axie Infinity Ronin sidechain hack to North Korea

90 points by nscalf 4y ago

deleted 4y ago
[deleted]
encryptluks2 4y ago
- daemoens 4y ago
  The FBI is the one who's assigning blame this time, so it's a bit more credible.
  - pphysch 4y ago
    "FBI" and "credible" are two words that don't exactly mix, given very recent history [1][2] [1] - https://www.bbc.com/news/world-us-canada-60999431 https://www.bbc.com/news/world-us-canada-60999431 [2] - https://www.cnn.com/2022/04/11/politics/trump-doj-strzok-deposition-subpoena/index.html https://www.cnn.com/2022/04/11/politics/trump-doj-strzok-dep...
- jack_pp 4y ago
  That's a plausible scenario but I assume the FBI has good reason to suspect NK otherwise we assume they attribute all big hacks to them.
- jmuguy 4y ago
  Their scam is already wildly popular, no need to get even greedier.
- adhesive_wombat 4y ago
  Whatever the chances of it happening, the prospect of watching some crypto scammer get a 10 year fraud (or whatever) sentence in a relatively open prison turned into an extradition and 200 consecutive life sentences in a supermax due to national security and sanctions violations would be...something. I'm not sure even a crypto scammer deserves that, but only because I'm not really sure anyone does.
  - whatshisface 4y ago
    They'd just demonstrate control of the funds and clear their name before they went to jail.
    - adhesive_wombat 4y ago
      Hmm, true. So if there's ever a scammer they can't quite prove has the assets, the police can claim they sent it to NK and they only way to avoid The Hole is to cop to the real scam. That's probably worryingly legal too.
      - whatshisface 4y ago
        That's where innocent until proven guilty comes in, which still does exist even if courts happily accept forms of evidence with extremely low empirical standards.
- deleted 4y ago
  [deleted]
assbuttbuttass 4y ago
I would say this is one of the primary use cases for a decentralized currency, from the perspective of avoiding sanctions as an economically isolated country. I've also seen an argument from Ukrainian activists who are using crypto when Russia froze their bank accounts.
- bombcar 4y ago
  Which is even more amusing because the Ukrainian activists using crypto to bypass a Russian freeze may very well be trading on-chain with Russian oligarchs evading sanctions.
- ea550ff70a 4y ago
  They (Kim's gang) are never going to be able to really take advantage of the funds as the associated addresses have been fully blacklisted around the world and they are never going to be able to find enough liquidity on alternative mediums in order to fully cash in. What a waste. This only helps deflate the crypto a bit more which I guess is good for the hodlers.
  - arisAlexis 4y ago
    Defi and dex mixers to privacy coins or projects like secret is or will be doable.
chasing 4y ago
Currency created to get around regulations used to get around regulations. News at 11.
- ed25519FUUU 4y ago
  The story here is actually that NK is now targeting crypto exchanges in their panoply of hacking targets.
  - lordnacho 4y ago
    That can't be new though? Gotta be the most obvious target on any list.
typest 4y ago
It seems that crypto and blockchain-based systems may well hurt the standing of the US if they allow US adversaries to evade financial sanctions. I wonder if US lawmakers would step in to try to shut down these systems. It may be politically very difficult since there is so much money riding on crypto now, and many US lawmakers reflexively support crypto in order to appear pro innovation.
- adventured 4y ago
  The power of the USD and related sanctions isn't whether North Korea can move trivial sums of money in the process of modest criminal activities (trivial and modest in the scale of national economies of consequence), it's whether you can heavily limit their ability to freely trade with the global economy. Bitcoin and Ethereum are not going to help North Korea very much in the scope of what they'd require. The US will (sooner or later) notice if X country in Asia suddenly starts doing $20 billion per year in crypto-based trade with North Korea, and that X country can be damaged economically as necessary to dissuade (make it not worth doing). That ability continues until you can convince most nations to abandon their currencies and turn all of that economic self-determination and political power over to independent crypto systems they have no control over. It ain't gonna happen.
- bko 4y ago
  Have financial sanctions worked in anything other than making the people of the country remain poor?
  - vkou 4y ago
    Making your adversary poor is the whole point of sanctions, so no. But that is the end in itself. Poor countries have a much harder time waging offensive wars. It also supplies a opposing fact to some forms of internal propaganda, especially when tied to a discrete event in the country's foreign policy.
    - chrischen 4y ago
      The counter argument to that justification of sanctions is that financial interdependence also discourages war. I mean, if North Korea gets nukes they can still shoot them and cause a lot of trouble, and we pretty much have no additional leverage aside from direct military intervention or taking the people one step further from poor -> dead. With Russia sanctions are doing some damage right now, even if it hasn’t stopped the war. With North Korea we’ve blown our load and the main casualty is just a destitute population over there.
TAKEMYMONEY 4y ago
> The Axie DAO allowlisted Sky Mavis to sign various transactions on its behalf. This was discontinued in December 2021, but the allowlist access was not revoked. Once the attacker got access to Sky Mavis systems they were able to get the signature So a question remains of how the attacker got access to Sky Mavis systems? > A security audit likely would have identified an inherent problem in the majority of the multisig keys being stored on a single server. There was no security aduit? Can anyone more familiar with this project add context?
- woah 4y ago
  The context here is that Axie was using a "proof of authority" blockchain, which is controlled by a predetermined set of signers. This is already very bad because it makes them a custodian of the money on the chain. Worse, they used it in a very insecure way where they held a majority of the keys on one server. So, not only did they call an effectively centralized server a "blockchain", they also acted deceptively about the number of centralized custodians on that multisig, by pretending there were 9 entities when there was only one. Most likely, the underlying code was audited as being secure when used by a larger group of independent validators. If there were 20, it would be very hard to compromise them all. The code that was broken was probably some other dumb utility on the server that got hit by a regular privilege escalation vulnerability or something.
  - nscalf 4y ago
    Spot on. They said they're increasing the number of validators, but ultimately the biggest issue with how they implemented this was that they put so many multisig keys in the same spot. They could have 100,000 validators, if 50,001 multisig keys are on their server, and they need a simple majority, it's just as vulnerable. They did say that they are expanding the amount of individual entities holding multisig keys, so they seem to realize this was a bad idea.
timcavel 4y ago
- kspacewalk2 4y ago
  A perpetually starving totalitarian absolute monarchy?
  - pphysch 4y ago
    don't forget the State mandated haircuts https://youtu.be/2BO83Ig-E8E https://youtu.be/2BO83Ig-E8E
rossjudson 4y ago
Seems like a lot of crypto stories end with, "And none of the investors ever saw their money again".
- nscalf 4y ago
  Sky Mavis raised $150M, and is going to be funding the remaining ~$470M to make investors whole. This doesn't look like it's one of those stories.
  - Barrin92 4y ago
    wait, they raised another 150 million after they just lost 600 million? And they just have 470 million lying around? I honestly give up, I don't understand anything any more
    - SkyMarshal 4y ago
      Yeah I want to do business with those investors putting in the $150 million, since they appear to be in the business of giving away free money.
      - nscalf 4y ago
        They're not unknown investors, Binance and a16z are in the round.
lvl102 4y ago
Anyone notice GPUs magically started to appear for sale right around the time Russian sanctions went into effect? I wonder why…
la_fayette 4y ago
Ok nice. So NK uses the internet, www, email, computers, mathematics...

90 points by nscalf 4y ago

deleted 4y ago

[deleted]

encryptluks2 4y ago

daemoens 4y ago
The FBI is the one who's assigning blame this time, so it's a bit more credible.
- pphysch 4y ago
  "FBI" and "credible" are two words that don't exactly mix, given very recent history [1][2] [1] - https://www.bbc.com/news/world-us-canada-60999431 https://www.bbc.com/news/world-us-canada-60999431 [2] - https://www.cnn.com/2022/04/11/politics/trump-doj-strzok-deposition-subpoena/index.html https://www.cnn.com/2022/04/11/politics/trump-doj-strzok-dep...
jack_pp 4y ago
That's a plausible scenario but I assume the FBI has good reason to suspect NK otherwise we assume they attribute all big hacks to them.
jmuguy 4y ago
Their scam is already wildly popular, no need to get even greedier.
adhesive_wombat 4y ago
Whatever the chances of it happening, the prospect of watching some crypto scammer get a 10 year fraud (or whatever) sentence in a relatively open prison turned into an extradition and 200 consecutive life sentences in a supermax due to national security and sanctions violations would be...something. I'm not sure even a crypto scammer deserves that, but only because I'm not really sure anyone does.
- whatshisface 4y ago
  They'd just demonstrate control of the funds and clear their name before they went to jail.
  - adhesive_wombat 4y ago
    Hmm, true. So if there's ever a scammer they can't quite prove has the assets, the police can claim they sent it to NK and they only way to avoid The Hole is to cop to the real scam. That's probably worryingly legal too.
    - whatshisface 4y ago
      That's where innocent until proven guilty comes in, which still does exist even if courts happily accept forms of evidence with extremely low empirical standards.
deleted 4y ago
[deleted]

assbuttbuttass 4y ago

I would say this is one of the primary use cases for a decentralized currency, from the perspective of avoiding sanctions as an economically isolated country. I've also seen an argument from Ukrainian activists who are using crypto when Russia froze their bank accounts.

bombcar 4y ago
Which is even more amusing because the Ukrainian activists using crypto to bypass a Russian freeze may very well be trading on-chain with Russian oligarchs evading sanctions.
ea550ff70a 4y ago
They (Kim's gang) are never going to be able to really take advantage of the funds as the associated addresses have been fully blacklisted around the world and they are never going to be able to find enough liquidity on alternative mediums in order to fully cash in. What a waste. This only helps deflate the crypto a bit more which I guess is good for the hodlers.
- arisAlexis 4y ago
  Defi and dex mixers to privacy coins or projects like secret is or will be doable.

chasing 4y ago

Currency created to get around regulations used to get around regulations. News at 11.

ed25519FUUU 4y ago
The story here is actually that NK is now targeting crypto exchanges in their panoply of hacking targets.
- lordnacho 4y ago
  That can't be new though? Gotta be the most obvious target on any list.

typest 4y ago

It seems that crypto and blockchain-based systems may well hurt the standing of the US if they allow US adversaries to evade financial sanctions. I wonder if US lawmakers would step in to try to shut down these systems. It may be politically very difficult since there is so much money riding on crypto now, and many US lawmakers reflexively support crypto in order to appear pro innovation.

adventured 4y ago
The power of the USD and related sanctions isn't whether North Korea can move trivial sums of money in the process of modest criminal activities (trivial and modest in the scale of national economies of consequence), it's whether you can heavily limit their ability to freely trade with the global economy. Bitcoin and Ethereum are not going to help North Korea very much in the scope of what they'd require. The US will (sooner or later) notice if X country in Asia suddenly starts doing $20 billion per year in crypto-based trade with North Korea, and that X country can be damaged economically as necessary to dissuade (make it not worth doing). That ability continues until you can convince most nations to abandon their currencies and turn all of that economic self-determination and political power over to independent crypto systems they have no control over. It ain't gonna happen.
bko 4y ago
Have financial sanctions worked in anything other than making the people of the country remain poor?
- vkou 4y ago
  Making your adversary poor is the whole point of sanctions, so no. But that is the end in itself. Poor countries have a much harder time waging offensive wars. It also supplies a opposing fact to some forms of internal propaganda, especially when tied to a discrete event in the country's foreign policy.
  - chrischen 4y ago
    The counter argument to that justification of sanctions is that financial interdependence also discourages war. I mean, if North Korea gets nukes they can still shoot them and cause a lot of trouble, and we pretty much have no additional leverage aside from direct military intervention or taking the people one step further from poor -> dead. With Russia sanctions are doing some damage right now, even if it hasn’t stopped the war. With North Korea we’ve blown our load and the main casualty is just a destitute population over there.

TAKEMYMONEY 4y ago

> The Axie DAO allowlisted Sky Mavis to sign various transactions on its behalf. This was discontinued in December 2021, but the allowlist access was not revoked. Once the attacker got access to Sky Mavis systems they were able to get the signature So a question remains of how the attacker got access to Sky Mavis systems? > A security audit likely would have identified an inherent problem in the majority of the multisig keys being stored on a single server. There was no security aduit? Can anyone more familiar with this project add context?

woah 4y ago
The context here is that Axie was using a "proof of authority" blockchain, which is controlled by a predetermined set of signers. This is already very bad because it makes them a custodian of the money on the chain. Worse, they used it in a very insecure way where they held a majority of the keys on one server. So, not only did they call an effectively centralized server a "blockchain", they also acted deceptively about the number of centralized custodians on that multisig, by pretending there were 9 entities when there was only one. Most likely, the underlying code was audited as being secure when used by a larger group of independent validators. If there were 20, it would be very hard to compromise them all. The code that was broken was probably some other dumb utility on the server that got hit by a regular privilege escalation vulnerability or something.
- nscalf 4y ago
  Spot on. They said they're increasing the number of validators, but ultimately the biggest issue with how they implemented this was that they put so many multisig keys in the same spot. They could have 100,000 validators, if 50,001 multisig keys are on their server, and they need a simple majority, it's just as vulnerable. They did say that they are expanding the amount of individual entities holding multisig keys, so they seem to realize this was a bad idea.

timcavel 4y ago

kspacewalk2 4y ago
A perpetually starving totalitarian absolute monarchy?
- pphysch 4y ago
  don't forget the State mandated haircuts https://youtu.be/2BO83Ig-E8E https://youtu.be/2BO83Ig-E8E

rossjudson 4y ago

Seems like a lot of crypto stories end with, "And none of the investors ever saw their money again".

nscalf 4y ago
Sky Mavis raised $150M, and is going to be funding the remaining ~$470M to make investors whole. This doesn't look like it's one of those stories.
- Barrin92 4y ago
  wait, they raised another 150 million after they just lost 600 million? And they just have 470 million lying around? I honestly give up, I don't understand anything any more
  - SkyMarshal 4y ago
    Yeah I want to do business with those investors putting in the $150 million, since they appear to be in the business of giving away free money.
    - nscalf 4y ago
      They're not unknown investors, Binance and a16z are in the round.

lvl102 4y ago

Anyone notice GPUs magically started to appear for sale right around the time Russian sanctions went into effect? I wonder why…

la_fayette 4y ago

Ok nice. So NK uses the internet, www, email, computers, mathematics...