Crypto Hackers Steal $615m From Ronin Network

Another hack has rocked the crypto world this week, after a gaming-focused blockchain network admitted hackers have stolen over $615m in USDC (a US dollar pegged stablecoin) and ethereum.

Axie Infinity’s Ronin Network made the admission in a blog post on Tuesday, and the $615m loss surpasses the $611 million hack of decentralised finance, or DeFi, Poly Network in August 2021.

The Ronin Network supports the popular blockchain game Axie Infinity, which lets users earn money as they play.

Ronin Network compromise

In the blog post, the Ronin Network said that most of the hacked funds are still in the hacker’s wallet.

“The Ronin bridge has been exploited for 173,600 Ethereum and 25.5M USDC,” it wrote. “We are working with law enforcement officials, forensic cryptographers, and our investors to make sure all funds are recovered or reimbursed. All of the AXS, RON, and SLP on Ronin are safe right now.”

It said the security breach on the Ronin Network took place 23 March, when “Sky Mavis’s Ronin validator nodes and Axie DAO validator nodes were compromised resulting in 173,600 Ethereum and 25.5M USDC drained from the Ronin bridge in two transactions (1 and 2).”

The hacker apparently used hacked private keys in order to forge fake withdrawals.

Ronin Network discovered the attack after a user reported being unable to withdraw 5,000 ether from the bridge.

“We are in the process of conducting a thorough investigation; working with Chainalysis to monitor the stolen funds and Crowdstrike to handle forensics and the setup of surveillance tools,” it said in an update.

It said it was certain it was an external breach, and “all evidence points to this attack being socially engineered, rather than a technical flaw.”

“We are committed to ensuring that all of the drained funds are recovered or reimbursed, and we are continuing conversations with our stakeholders to determine the best course of action,” it said.

Previous crypto breaches

The Ronin Network could be the largest compromise to date of a decentralised finance platform, but there have been others.

This included the already mentioned $611 million hack of Poly Network in August 2021.

In 2019 hackers attacked one of the world’s largest cryptocurrency exchanges (Binance) and stole 7,000 bitcoins worth worth $41m at the time.

Binance said that the hackers had used ‘a variety of techniques’ to carry out the robbery.

Then in 2018 in Tokyo hackers broke into a cryptocurrency exchange called Coincheck and made off with nearly $500 million in digital tokens.

The crypto exchange platform Bitfinex in Hong Kong, which was the world’s largest dollar-based exchange for bitcoin, was hacked in August 2016, and 119,756 bitcoin was stolen from users’ accounts.

Prior to that in 2014, Tokyo-based bitcoin exchange Mt Gox filed for bankruptcy in the US and Japan after it lost 850,000 bitcoins (worth $500m at the time).

It had been targeted repeatedly by hackers.

In February this year the FBI arrested Ilya Lichtenstein, aged 34, and his wife, Heather Morgan, aged 31, both of New York, for an alleged conspiracy to commit money laundering, which carries a maximum sentence of 20 years in prison.

The FBI had been watching a digital wallet containing the 2016 Bitfinex proceeds that was under Lichtenstein’s control and swooped when they identified the couple.

The recovered bitcoin was valued at over $3.6 billion at the time of seizure.