Sky Mavis’ probable next steps after $612m hack

In the largest decentralized finance (DeFi) hack in history, attackers emptied the Ronin Bridge and the Katana decentralized crypto exchange (DEX) to make off with an eye-watering 173,600 ETH and US$25.5 million in USDC (a stablecoin pegged to the US dollar).

Ronin and Katana are infrastructures that support Sky Mavis’ wildly popular play-to-earn blockchain game Axie Infinity.

The heist occurred on March 23 but was only discovered on March 29 when a user was unable to withdraw 5,000 ETH from the bridge.

Sky Mavis responded by disabling the Ronin Bridge to avoid any further hacks. Cryptocurrency exchange Binance followed suit, disabling its bridge to Ronin. Sky Mavis also shut down its internal Katana DEX since no more funds could be deposited into the ecosystem.

It is unclear to what extent user funds were hacked. Sky Mavis announced in a blog post that it is “committed to ensuring that all of the drained funds are recovered or reimbursed.”

The tokens for Ronin (RON) and Axie Infinity (AXS), as well as the game’s in-game currency (SLP), are likely safe from any similar hacks – although they are not safe from a potentially enormous loss of value once the bridge reopens and panicked users sell and exit the ecosystem.

How did the attacker pull off the hack?

Sky Mavis’ Ronin chain is highly centralized – it consists of nine validator nodes. The attacker initially gained access to four Sky Mavis Ronin validators and then exploited a back door through Sky Mavis’ gas-free RPC node to get the signature for the Axie decentralized autonomous organization (DAO) validator, bringing them to the 5/9 threshold they needed to validate withdrawals through the bridge.

Sky Mavis explained that the threshold was so low because “some nodes didn’t catch up with the chain or were stuck in a syncing state.”

What will happen to the stolen funds?

The US$25.5 million in USDC has been withdrawn, along with 6,250 of the 173,500 ETH, but most of the ETH is still in the attacker’s wallet. This is a bit odd, as the typical play after hacking funds is to run them through privacy mixers such as Tornado Cash and/or privacy coins such as Monero to prevent the funds from being tracked and frozen.

Given the size of the hack, the attacker may have wisely concluded that even with what turned out to be a six-day head start, they would be unable to cash out or even hide all that currency without being identified by law enforcement. Their plan is likely to negotiate with Sky Mavis.

Crypto hacks are different from bank robberies: They involve somewhat fewer police and significantly more tweeting.

Has currency on Ronin lost value?

What will happen to Axie Infinity?