Sky Mavis raises $150M, funds to be restored on the Ronin Bridge

Single serving.

There's good commentary on Axie Infinity (the Sky Mavis game which got hacked) and links to more detailed explanations here.

https://web3isgoinggreat.com/?id=2022-03-29-0

(particularly by Molly White the owner of the web3isgoinggreat https://blog.mollywhite.net/axie-hack/ )

And it appears the final key was also under the control of the same organization temporarily.

I don't have more details because I don't think they've released any, but fundamentally, that appears to be the critical vulnerability which made this hack almost inevitable.

They began with a system that was extremely carefully designed to be decentralized (multiple signers) and then they centralized it.

Subsequently, the hacker only had to attack one organization, instead of five

Incompetence? Inside job? Or why not both?

- The bridge was controlled by a 5 of 9 validator set (ie. 5 of the 9 nodes needed to agree to withdrawals and deposits between Ethereum and Ronin)

- 4 of these nodes were run by Sky Mavis themselves (a bad idea), those were compromised because their internal infra was compromised in some traditional social engineering attack (ie. not blockchain related, just a normal cloud infra compromise)

- 1 of the nodes was run by the community-operated Axie DAO. However, that node had whitelisted Sky Mavis' cloud infrastructure a while back to allow them to run transactions through Axie DAO's node in order to use Axie DAO treasury funds to pay gas on user's behalf (to help with onboarding into Ronin).

This was discontinued, but they forgot to remove the whitelist (another critical mistake), so the hackers were able to use that Axie DAO node for the final 5th verification needed to steal bridge funds (because they had compromised the whitelisted Sky Mavis cloud infra).

TLDR: A traditional cloud infra compromise via unspecified social engineering attack, compounded by an insufficiently decentralized validator set allowing the bridge funds to be "withdrawn" to hacker's wallets by forging fake signatures. This is why decentralization is important in blockchain infra, and they learned the hardest way possible.

Hope that helps!

> The 56,000 ETH compromised from the Axie DAO treasury will remain undercollateralized

The investors are handing over cash to invest in the company. The currency will run without backing from now on. That means any big users trying to withdraw at the same time won't be able to. And if that happens, the investors money won't be used to fill the gap.

You're eighteen years old and see a Twitch streamer talking about how he's making $4000 / day by earning $SCAM tokens on this game. It doesn't look like a very interesting game, but you're good at games, why shouldn't you do this too?

To start earning by playing, just one small step: you first need to buy a character. They cost about $500 but of course it's a great investment. The only way to buy the character is with the $SCAM tokens, so first you just need to convert your $500, credit cards accepted...

And that is the real-world cashflow that pays the Twitch streamer and the company and the VCs. The tokens you earn in the game are only worth something as long as there's a steady stream of hopeful players bringing real money into the system.

It sounds like they're putting in a bunch of their own money as well to reimburse people. I guess we'll only find out when they actually do that though if they are doing a full reimbursement.

"The round combined with Sky Mavis balance sheet funds, will be used to ensure that all users affected by the Ronin Validator Hack will be reimbursed. "

Remember, if you scam or charge $700M from your casino game users, you can accept $625M lost to theft and still make a profit.

But the announcement says "if this isn't enough to stabilize the coin, we'll take a treasury vote" presumably either to raise more funds or to default on their (non-legal) obligations to users.

Code is law. Radical decentralization. Users should not expect to get any money back from Sky Mavis (or any other cryptocurrency system). That's what they signed up for.

It is one of the most popular of these blockchain games, and like most of them it operates as sort of a pyramid/ponzi. Winning battles with your axies rewards blockchain tokens which can be used to breed more axies which may be sold for real money to new players who are joining the game. There is also a lending system where the rich axie holders can lease axies to people in developing countries that can't afford to buy them outright, in exchange for a cut of the rewards. As usual, the whole thing doesn't make a lot of economic sense, so don't try to look for some economic justification that isn't there.

As for the hack, originally all the transactions and axie trading happened directly on ETH blockchain but that was too expensive because each ETH transaction is dozens of dollars. So Sky Mavis created a side chain for the game. You can deposit your ETH in the Sky Mavis account / smart contract. Then you can trade axies with other players using this account balance. Later, redeem the account balance for real eth to cash out. What the hackers did was steal the private keys for the sky mavis account and ran away with all the funds. We don't know if it was an external hacker or an inside job. Basically it's similar to the various cryptocurrency exchange hacks such as MtGox, Bitfinex, etc.

Typical use cases include scamming retail investors and evading taxes.

So instead of having a centralized db, Axie (and other blockchain tech) farms out this work and storage out to 9 computers?

Obviously their legal creditors in the real financial system (not the suckers buying coins) would prefer repayment to default, so it's in their interest to negotiate a new collateralization agreement to extract more money from "game" players (speculators) before shutting down and writing off the loss.