Categories
Game

‘Axie Infinity’ CEO moved $3 million in crypto tokens before disclosing massive hack

On March 23rd, hackers broke into Axie Infinity’s Ronin network to steal Ethereum and USDC stablecoins that were then worth over $600 million. In response to the massive theft, Axie developer Sky Mavis disabled token withdrawal — but apparently not before its CEO moved $3 million worth of Axie’s main token, AXS, into Binance. According to Bloomberg, company CEO and co-founder Trung Nguyen made the large transfer mere hours before Sky Mavis disclosed on March 29th that the “play to earn” game was hacked. 

It was YouTube user Asobs who first identified the transaction and who shared his documentation with Bloomberg. The news organization then worked with associate professors of mathematics at Winthrop University to confirm his findings. Asobs analyzed the transaction details and connected it to a wallet controlled by Nguyen based on previous transactions, such as the initial distribution of tokens for the game during its early years. 

When asked, company spokesperson Kalie Moore has confirmed the transaction to Bloomberg. Moore said Nguyen made the transfer to shore up the company’s finances and ensure it could provide liquidity to its users. Nguyen apparently had to do so on the down-low so that people tracking official Axie wallets wouldn’t be able to front-run the news and cash out before the rest of the players even find out what’s going on.

Moore said:

“At the time, we (Sky Mavis) understood that our position and options would be better the more AXS we had on Binance. This would give us the flexibility to pursue different options for securing the loans/capital require. The Founding Team chose to transfer it from this wallet to ensure that short-sellers, who track official Axie wallets, would not be able to front-run the news.”

Nguyen posted a Twitter thread after Bloomberg’s report went up and said that his team had been in contact with Binance after the hack was discovered to “ensure user funds would be restored as soon as possible.” The executive added: “This discussion included the fact that Sky Mavis would provide liquidity while we worked on a full backing of the bridge.” He also called speculations of insider trading as “baseless and false.”

In Axie Infinity, people can earn cryptocurrency by playing the game and completing tasks, such as winning Arena battles and breeding Axie monsters, which are non-fungible tokens. The attack on its Ronin network is now known as one of the biggest in crypto history. According to previous reporting by The Block, bad actors gained entry into its system by sending a spyware-filled PDF to one employee who thought he was getting a job offer with higher pay from another firm. Turns out the company didn’t exist, and the offer, according to the US government, came from North Korean hacker group Lazarus.

Sky Mavis has secured $150 million in funding to help reimburse users since then, and Nguyen said all players’ funds are now backed 1:1. The value of Ethereum dropped considerably since March, however, so players will not get the money they could’ve gotten if they had cashed out months ago. As for the game itself, it opened back up in late June with a new system to flag “large, suspicious withdrawals” and a new land-staking feature that enables players to earn passive income.

All products recommended by Engadget are selected by our editorial team, independent of our parent company. Some of our stories include affiliate links. If you buy something through one of these links, we may earn an affiliate commission.



Repost: Original Source and Author Link

Categories
Game

‘Axie Infinity’ is back open for business following $625 million hack

After a massive $625 million hack, the cryptocurrency pay-to-earn game Axie Infinity is once again open for business. The hack took advantage of flaws in the Ronin network, an Ethereum sidechain the game’s owner, Sky Mavis, propped up to facilitate faster transactions. Surprisingly, the news today is that Axie Infinity will… continue to use Ronin, which has been revived after a few audits. In a blog post, the company described a new “circuit-breaker” system designed to flag “large, suspicious withdrawals,” withdrawal limits and human reviewers. It also promised players that a new land staking feature — which claims to allow the game’s owners of digital land to earn passive income — will be released later this week.

In March, a group of hackers pilfered nearly 173,600 Ethereum and nearly 26 million USDC (worth roughly $26 million) from the game’s network. US officials have since linked the North Korean-backed hacking group Lazarus to the heist. Last week Sky Mavis said it would begin reimbursing the victims of the hack — but didn’t account for Ethereum’s drop in value over the past three months, which means that users would only recover about a third of their losses. In all, Sky Mavis is returning $216.5 million in funds to its users.

Moving forward, Axie Infinity players are warned not to send funds directly to Ronin Bridge’s smart contract address. “The Ronin Bridge should only be accessed and used for deposits/withdrawals through the Ronin Bridge UI. Any funds sent directly to the Ronin Bridge’s contract addresses will be permanently lost,” wrote the company in its post.

Esports.net recently pointed out a flaw in Axie Infinity’s design — a drop in the number of players causes the value of its in-game currency to plummet. Bloomberg noted earlier this month that the game’s user base has declined by 40 percent since the hack. As of this writing, the value of AXS is at $15.30 (a drop from its high of $160.36 in July 2021) and the value of SLP is at 0.0039 (down from an all-time high of 0.364).

All products recommended by Engadget are selected by our editorial team, independent of our parent company. Some of our stories include affiliate links. If you buy something through one of these links, we may earn an affiliate commission.

Repost: Original Source and Author Link

Categories
Security

Axie Infinity NFT game reopens transactions months after $625 million theft

Ronin Bridge, the link that enables users to transfer funds to and from accounts in the “play to earn” Axie Infinity game, has reopened following a $625 million theft that took place in March. Sky Mavis, the developer group behind Axie Infinity and the Ronin blockchain that powers the game, announced that players can now use the bridge to make deposits and withdrawals.

Since March, the Ronin Bridge has been closed off as Sky Mavis worked to bolster its security protocols and recover users’ funds. The attack went unnoticed for six days until a user tried to withdraw funds and couldn’t do it. In a postmortem, Sky Mavis blamed a spear-phishing attack that compromised an employee’s account, saying that person no longer works with the company, as well as its lack of a tracking system to monitor large outflows.

After conducting an investigation, the US Treasury Department attributed the hack to the North Korean hacking group Lazarus and issued sanctions on the wallet address containing the stolen cryptocurrency. Sky Mavis initially planned to have the bridge up and running by the end of April but later delayed its reopening, citing that “this is not a process we can afford to rush” because the bridge “will secure billions of dollars in assets.”

Sky Mavis appears to have followed through on its promise to compensate players affected by the theft. Although it notes that users’ funds are “fully backed 1:1 by the new bridge,” Sky Mavis still hasn’t made up for a large portion of the Ronin network’s stolen funds. After pooling money from the founding members of the Sky Mavis team and receiving $150 million in funding from a number of companies, including Binance, the firm says Ronin’s currently down 71,600 ETH (~$85.8 million) and 25.5 million USDC ($25.5 million). Sky Mavis says it’s reimbursing these liabilities in full.

But this still doesn’t account for the 56,000 wETH (~$67.2 million) drained from the Axie DAO (decentralized autonomous organization) Treasury, the group of people who vote on decisions for the Axie community. Sky Mavis says it’s working with law enforcement to retrieve these funds. If it doesn’t recover them within two years, the DAO will cast a vote on the “next steps.”

In a message on Discord, developers told players they’re also on track to add Land Staking this week, which is another scheme to help generate rewards for players who’ve invested money in the game. The Verge senior entertainment editor Andrew Webster tried playing the game and said, “The creatures are all extremely similar, and experimentation is nonexistent unless you want to fork out a bunch of cryptocurrency.”

It’s unclear what these changes will do to improve the actual gaming experience, even if the back end is, now, more secure. Shortly after the attack, Sky Mavis launched Axie Infinity: Origin, a newer version that includes free-to-play elements to try and attract new players who don’t have blockchain wallets yet.

To help prevent future thefts, the Ronin Bridge has undergone one internal audit and two external audits by blockchain security firms Verichains and Certik. The bridge also has a new “circuit-breaker system” designed to stop suspicious users from making unusually large withdrawals. You can read more about Ronin’s update in its blog post, as well as read up on its technical documentation.



Repost: Original Source and Author Link

Categories
Game

‘Axie Infinity’ hack victims will only get back around a third of what they lost

Sky Mavis, the developer of blockchain game Axie Infinity, says it will start reimbursing the victims of a $617 million hack that took place earlier this year. The attackers took $25.5 million in USDC (a stablecoin that’s pegged to the value of the US dollar) and 173,600 ether, which was worth around $591.2 million at the time. The FBI claimed North Korean state-backed hacker groups were behind the attack.

Impacted Axie Infinity players will be able to withdraw one ether token for each one they lost in the hack, Sky Mavis told Bloomberg (the company didn’t mention a USDC reimbursement). However, as with other cryptocurrencies, the value of Ethereum has plummeted since the attack in March. 

Because of that, Sky Mavis will return around $216.5 million to users. It’s possible that the price of Ethereum will rise again, but as things stand, affected users will get back around a third of what they lost.

In April, Sky Mavis raised $150 million in funding to help it pay back the victims. The developer plans to reimburse affected users on June 28th, when it restarts the Ronin software bridge that the hackers targeted. 

Axie Infinity is widely considered the most popular play-to-earn game. Players collect and mint NFTs representing creatures that battle each other, Pokémon-style. These NFTs can be sold to other players, with Sky Mavis charging a transaction fee. By February, Axie Infinity had facilitated $4 billion in NFT sales.

However, the NFT market has all but bottomed out, which has had a significant impact on Axie Infinity. For one thing, according to Bloomberg, the daily active user count dropped from 2.7 million in November to a quarter of that by the end of May.

All products recommended by Engadget are selected by our editorial team, independent of our parent company. Some of our stories include affiliate links. If you buy something through one of these links, we may earn an affiliate commission.

Repost: Original Source and Author Link

Categories
Security

US blames North Korean hacker group for $625 million Axie Infinity theft

The US Treasury Department blames North Korean hacking group Lazarus for stealing $625 million in cryptocurrency from the Ronin network, the blockchain backing the Axie Infinity play-to-earn crypto game, according to a report from Vice. On Thursday, the Department of Treasury updated sanctions to include the wallet address that received the funds and attributed it to the Lazarus group.

In an updated post about the incident, the Ronin network, which is owned by developer group Sky Mavis, explains the US Department of Treasury and FBI have pinned the attack on Lazarus. “We are still in the process of adding additional security measures before redeploying the Ronin Bridge to mitigate future risk,” the post reads. “We expect to deliver a full post mortem that will detail security measures put in place and next steps by the end of the month.” Ronin says it will bring its bridge back online “by the end of the month.” The bridge allows users to transfer funds between other blockchains and Axie Infinity and has been blocked off since the attack.

As noted by Vice, the flagged wallet address currently contains over $445 million USD (148,000 Ethereum) and sent almost $10 million (3,302.6 ETH) to another address less than a day ago. Crypto transaction tracker Etherscan labels the address as “reported to be involved in a hack targeting the Ronin bridge.”

On March 29th, hackers made off with $625 million worth of Ethereum in one of the biggest crypto heists to date. According to cryptocurrency investigation group Chainanalysis, the Lazarus group is tied to North Korea’s intelligence agency and was responsible for seven attacks last year. The group gained notoriety for hacking Sony Pictures in 2014, leaking The Interview, a comedy set in North Korea directed by Seth Rogen. It later used Trojan malware to steal millions from ATMs across Asia and Africa in 2018 and has also been linked to WannaCry ransomware.

Repost: Original Source and Author Link