For all the benefits that are glamourized by enthusiasts, cryptocurrencies have their cons as well. Gaming-focused blockchain Ronin Network found that out the hard way as it became the latest victim of a massive crypto theft, which cost it over $625 million worth of cryptocurrency.
The breach was discovered earlier today when a user was unable to withdraw 5000 ETH (Ethereum) from the bridge, but it seems to have occurred on March 23, last Wednesday. The hacker made away with 173,600 Ethereum and 25.5 million USDC (USD coin, which is a stablecoin) over the course of two transactions, using hacked private keys in order to forge fake withdrawals.
While 6,250 ETH has been transferred to various other addresses, most of the stolen funds continue to remain with the attacker.
In response to the theft, Ronin has paused the Ronin Bridge and disabled Katana DEX for now, and will reopen the bridge later. Additionally, it is working with law enforcement officials, forensic cryptographers, and its investors to make sure all funds are recovered or reimbursed.
For those who do not know, Ronin Network supports the popular blockchain video game Axie Infinity, and acts as a bridge between the video game and blockchains, helping in the transfer of cryptocurrency in and out of the game.
Axie Infinity lets players creature-centric NFTs enter the game and then spend more cryptocurrencies to acquire and breed various beasts they can deploy in battles. Users could either make deposits in Ronin and purchase NFTs or in-game currency or could sell their in-game assets and withdraw the money.
Ronin revealed that the hacker gained access to five (Sky Mavis’s four Ronin Validators and a third-party validator run by Axie DAO) of the nine validator nodes required to let users make deposits or withdrawals. It exploited a backdoor through its gas-free RPC node to get the signature for the Axie DAO validator once it had access to Sky Mavis systems.
However, Sky Mavis assured that the AXS, SLP, and RON (in-game cryptocurrencies of the Axie Infinity gaming metaverse) have not been compromised and are safe. It is also migrating its nodes, which are separated from its old infrastructure. It is also working with Chainalysis to monitor the stolen funds.
“As we’ve witnessed, Ronin is not immune to exploitation and this attack has reinforced the importance of prioritizing security, remaining vigilant, and mitigating all threats,” the company said. “We know trust needs to be earned and are using every resource at our disposal to deploy the most sophisticated security measures and processes to prevent future attacks.”
