Key Takeaways
Ronin Network, the sidechain used in the popular play-to-earn game Axie Infinity, suffered a major exploit on Mar. 23.
A hacker compromised five validator nodes and stole 173,600 Ethereum and 25.5 million USDC from the Ronin bridge at a value of around $551.8 million. The Ronin team discovered the exploit six days later.
The Ronin team has paused the bridge and is taking various steps to track the hacker, a blog post confirmed.
Share this article
The Ronin bridge and Katana exchange have been halted following the incident.
Axie Infinity Network Suffers Vulnerability
Axie Infinity’s Ronin Network has been hit by a major security breach.
The Ronin team confirmed the incident late Tuesday. A blog post revealed that its Ronin validator nodes and Axie DAO validator nodes were compromised on Mar. 23, resulting in losses of 173,600 Ethereum and 25.5 million USDC. Based on Ethereum market prices on Mar. 23, the losses amount to around $551.8 million.
The blog post revealed that the hacker used hacked private keys so that they could forge withdrawals. Bizarrely, the compromise was only discovered today, six days after the attack, when someone reported that they had struggled to withdraw 5,000 Ethereum from the bridge.
The Ronin chain uses just nine validator nodes (for context, Ethereum has around 300,000 validators, while Solana has closer to 1,000). To confirm a deposit or withdrawal, it requires five validator signatures. The hacker successfully drained the funds because they took control of four Ronin validators and another validator run by Axie DAO. The blog post said that although the validator key scheme it uses “is set up to be decentralized,” the attacker found a back door through a gas-free node that was set up amid soaring user demand.
The Ronin team said that it had increased the minimum number of validator signatures required for a deposit or withdrawal to eight in response to the incident. It’s also migrating its nodes and temporarily paused the Ronin Bridge and Katana exchange.
According to the blog post, this wallet containing 175,913 Ethereum holds the majority of the stolen funds. Ahead of the exploit, the same wallet interacted with Binance. That suggests that there may be a way of tracing the assailant. The Ronin team said that it was “working directly with various government agencies” and Chainalysis to track the hacker and the funds.
Ronin Network is an Ethereum sidechain launched by Sky Mavis, the blockchain game developer behind the NFT-based play-to-earn hit Axie Infinity. Sky Mavis experienced huge growth last year as NFTs boomed and interest in Axie Infinity soared, hitting a valuation of almost $3 billion in October. Axie Infinity players use Ronin to trade in-game tokens. In the blog post, the Ronin team admitted that while the network “was not immune to exploitation,” it was working to ensure that no users’ funds are lost. “All of the AXS, RON, and SLP on Ronin are safe right now,” the post added.
AXS, RON, and SLP all tanked on the news. Unsurprisingly, RON was hit hardest. It’s down 9.4% at press time.
This story is developing and will be updated as more details emerge.
Disclosure: At the time of writing, the author of this piece owned ETH and several other cryptocurrencies.
Share this article
The information on or accessed through this website is obtained from independent sources we believe to be accurate and reliable, but Decentral Media, Inc. makes no representation or warranty as to the timeliness, completeness, or accuracy of any information on or accessed through this website. Decentral Media, Inc. is not an investment advisor. We do not give personalized investment advice or other financial advice. The information on this website is subject to change without notice. Some or all of the information on this website may become outdated, or it may be or become incomplete or inaccurate. We may, but are not obligated to, update any outdated, incomplete, or inaccurate information.
You should never make an investment decision on an ICO, IEO, or other investment based on the information on this website, and you should never interpret or otherwise rely on any of the information on this website as investment advice. We strongly recommend that you consult a licensed investment advisor or other qualified financial professional if you are seeking investment advice on an ICO, IEO, or other investment. We do not accept compensation in any form for analyzing or reporting on any ICO, IEO, cryptocurrency, currency, tokenized sales, securities, or commodities.
See full terms and conditions.
