Popular video game, Axie Infinity‘s blockchain platform- Ronin Network, has been exploited in a security breach. The cyber criminals stole over $615 million worth of Ethereum (ETH) and USDC in one of the largest crypto hacks of all time.
On March 29, Ronin Network, a sidechain of the Ethereum blockchain, revealed that it was attacked resulting in a loss of 173,600 Ethereum (ETH) and 25.5M USDC, now valued at more than $615 million. This happens to be the second-biggest hack ever in the cryptocurrency space.
How Did The Attack Happen?
According to the official blog post, Ronin Network said that the hack was discovered yesterday but it had actually occurred on Wednesday on March 23rd. The compromise was discovered after a report from a user being unable to withdraw 5k ETH from the Ronin bridge. The attackers use hacked private keys to “forge fake withdrawals” through a backdoor route, draining over 173,500 ether (ETH) and 25 million of the stablecoin, USD coin (USDC).
The blog post stated that the exploit affected Ronin Network validator nodes for Sky Mavis, the publishers of the popular Axie Infinity game, and the Axie DAO. Sky Mavis’ Ronin chain currently consists of 9 validator nodes.
In order to recognize a Deposit event or a withdrawal event, five out of the nine validator signatures are needed. The attacker managed to get control over Sky Mavis’s four Ronin Validators and a third-party validator run by Axie DAO. The company further wrote,
“Once the attacker got access to Sky Mavis systems they were able to get the signature from the Axie DAO validator by using the gas-free RPC.”
What Are The Precautionary Measures taken?
The platform said it is working with law enforcement as well as the blockchain forensic firm, Chainalysis, and has taken precautionary measures to beef up security for further attacks. The majority of the funds remain in the attacker’s address, although 6,250 ETH has been transferred to various other addresses. The Ronin Bridge and the Katana automated market maker (AMM) have both been disabled while investigations are ongoing.
Before Ronin, the largest hack of this year, was the $325 million theft through a flaw in Wormhole, a cross-chain bridge that allows users to transfer assets between the Ethereum and Solana blockchains. Last year, what is said to be the biggest exploit in the cryptocurrency industry, hackers stole more than $600 million in cryptocurrency from the decentralized finance platform, Poly Network.
