Hackers steal more than $600M from Ronin blockchain used to play Axie Infinity

It's one of the largest crypto heists in history.

The cryptocurrency used to play the Pokémon-inspired blockchain game Axie Infinity was the target of a March 23 crypto heist of more than $600 million, one of the largest in history.

In February 2021, the Ronin blockchain debuted. Ronin offers 20 free transactions to each account holder.

In a newsletter posted to the Ronin Network Substack page, its leaders said the Ronin bridge that connects Axie Infinity’s Ronin sidechain to ethereum and Katana Dex, a decentralized exchange in the Axie Infinity ecosystem, have been halted while they work with law enforcement, forensic cryptographers, and investors to recover the stolen cryptocurrency.

The hacker compromised the Ronin and third-party Axie DAO validator nodes using hacked private keys to forge fake withdrawals, the newsletter said.

The Ronin chain includes nine validator nodes of which five signatures are needed to deposit or withdraw cryptocurrency. The attacker took control of Sky Mavis’ four Ronin validators and a third-party validator run by Axie DAO, the newsletter said. 

Last week’s hack can be traced back to November 2021 when Sky Mavis, the company behind Axie Infinity, asked Axie DAO for support distributing free transactions due to what the Ronin newsletter called “an immense user load.” The arrangement continued until December 2021, but the newsletter said that “allowlist access” was not revoked when it ended, allowing the hacker to enter Sky Mavis systems and obtain “the signature from the Axie DAO validator.”

The Ronin newsletter said it is actively guarding against future attacks and have increased their validator threshold to eight from five. They said they have paused the Ronin bridge temporarily to be sure no attack vectors remain open.

“Hacks on the crypto sector have been a problem for years, and incidents involving multi-million dollar losses seem to be happening every few months implying an industry-wide security problem,” Emsisoft threat analyst Brett Callow said via email. “The real question is how many more of these incidents can occur before either people lose confidence in the sector or regulators feel it necessary to step in to protect the public.”

Ronin only learned of the breach on Tuesday, after a report from a user unable to withdraw from the bridge. Users with funds on Ronin Network cannot withdraw or deposit funds as of now, but Sky Mavis is committed to ensuring that all of the drained funds are recovered or reimbursed, the newsletter said.

“We are working with Chainalysis to monitor the stolen funds,” the newsletter said.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure