The amount initially reported at the time of the incident was $540 million, that has now risen to $615 million by the time of publishing this article - this is now crypto's second-largest crime.
When a user reported being unable to withdraw money from the Ronin bridge six days after the heist, Ronin Network developers detected the hack Tuesday morning.
The Ronin Network, an Ethereum side chain, is largely utilized as the payment rails for the popular play-to-earn game Axie Infinity, providing game players with lower transaction fees.
The incident occurred on March 23 when the attackers used hijacked private keys to "create bogus withdrawals" through a backdoor method, emptying 173,600 ether (ETH) and 25.5 million of the stablecoin, USD coin, according to a blog post from the Ronin network (USDC).
Validator nodes are used in blockchains to validate, vote on, and keep track of transactions. Ronin is made up of nine distinct validator nodes. Five of the nine nodes must approve a withdrawal or deposit in order for it to be recognized.
According to the Ronin Network, attackers obtained a signature by exploiting a backdoor flaw in the decentralized autonomous structure of the play-to-earn game.
“As of right now users are unable to withdraw or deposit funds to Ronin Network. Sky Mavis is committed to ensuring that all of the drained funds are recovered or reimbursed,” Ronan network says.
Stolen funds were done in 2 transaction to this wallet: https://etherscan.io/address/0x098b716b8aaf21512996dc57eb0615e2383e2f96
Strange Decisions - Perhaps NOT Dealing With Sophisticated Hackers?
In a surprising move, some has been transferred into accounts on the crypto exchange FTX - a centralized exchange that works with law enforcement and will surely return the stolen funds it possesses.
There's new movement on the wallet as well, it appears they're trying to use a bridge to move some of the remaining funds to another blockchain.
Limited Options...
Where would they go from here? It's important to understand how every option is a bad one. Mixers that scramble transactions of multiple peoples coins then spit them back out, in theory making them untraceable, do not have nearly enough liquidity to leave the hackers with any real progress. Maybe 0.5% per day could be 'cleaned' this way.
The public data on privacy coins would also make it obvious which wallet belongs to them - they simply have too much to stay under the radar
Worst case is they're able to take an amount small enough to use some of the very limited 'tricks' available. Making this an incredibly stupid decision - being guilty of stealing over $600 million, while hoping to be able to walk away with maybe $5 million of it in the end.
In Closing...
While this may sound like a disaster, software exists today used by exchanges and law enforcement capable of tracking every step these coins take. Spending any of this in the real world will be nearly impossible. The things people normally do with millions of dollars, like luxury travel, homes, cars, are all things that would instantly expose the identity of the criminals.
Most or all of the funds are likely to be returned.
-----------
Author: Ross Davis
Silicon Valley Newsroom
GCP | Breaking Crypto News
