Ronin, an Ethereum sidechain created for the popular NFT game Axie Infinity, was hacked, and an estimated $625 million in cryptocurrency was stolen from its bridge.
Sky Mavis, a developer, announced that the exploit occurred on March 23 but was just detected yesterday. According to the team’s report, the attacker utilized “hacked private keys” to carry out the exploit and so was able to fabricate transactions to claim the monies.
The attacker took 173,600 WETH or Wrapped Ethereum (almost $597 million) and 25.5 million USDC stablecoin (nearly $25.5 million), totaling around $622 million in crypto assets. The majority of the assets stolen are still in the hacker’s wallet.
According to the report, the attacker was able to sign transactions from five of the Ronin network’s nine existing validator nodes, which is the required threshold for signature approval. The attacker eventually acquired access to Sky Mavis’ four validators as well as one operated by Axie DAO.
“The validator key scheme is set up to be decentralized so that it limits an attack vector, similar to this one, but the attacker found a backdoor through our gas-free RPC node, which they abused to get the signature for the Axie DAO validator,” the report reads.
“This traces back to November 2021 when Sky Mavis requested help from the Axie DAO to distribute free transactions due to an immense user load,” it continues. “The Axie DAO allowed listed Sky Mavis to sign various transactions on its behalf. This was discontinued in December 2021, but the allow list access was not revoked.”
Sky Mavis says it has enlisted the help of law enforcement, Chainalysis’ forensic cryptographers, and its own investors to “ensure that all money is recovered or refunded.”
Axie Infinity Co-founder Jeff Zirlin described it as “one of the bigger hacks in history.” Some of the drained funds have already been sent from the attacker’s wallet to exchanges, and Zirlin said that “there’s a chance that they can be identified and brought to justice.”
Sky Mavis has disabled the bridge that connects Ronin to the Ethereum mainnet, allowing users to send dollars and assets back and forth, as well as the Katana decentralized exchange that runs on Ronin, as a result of the security incident.
Axie Infinity’s AXS and SLP tokens, as well as Ronin’s own RON governance token, are currently safe, according to the business. Sky Mavis discovered the flaw after someone tried to withdraw 5,000 ETH of their own money from Ronin and noticed that the bridge was down.
Wormhole, a cross-chain Ethereum/Solana bridge that was attacked for $320 million worth of WETH in early February, appears to be comparable to the Ronin bridge hack. Jump Crypto eventually repaid the stolen monies, presumably as a bet on the Solana ecosystem’s future.