Hackers Steal $540 Million in Crypto From ‘Axie Infinity’ Game [WSJ]

A cryp­tocur­rency startup that op­er­ates a pop­u­lar on­line game called “Axie In­fin­ity” said Tues­day that hack­ers stole more than $500 mil­lion worth of cryp­tocur­rency.

“Axie In­fin­ity” pub­lisher Sky Mavis Ltd. said on March 23, hack­ers in­fil­trated a part of its Ronin Net­work, which the game runs on. The in­fil­tra­tors got ac­cess to ac­counts hold­ing cryp­tocur­ren­cies and drained 173,600 ether and 25.5 mil­lion of the sta­ble­coin USDC.

“The breach hap­pened due to so­cial en­gi­neer­ing, not tech­ni­cal flaw,” said Alek­sander Larsen, op­er­at­ing chief and co-founder of Sky Mavis. While users are now un­able to with­draw or de­posit funds to Ronin Net­work, he said Sky Mavis is com­mit­ted to en­sur­ing that all of the drained funds are re­cov­ered or re­im­bursed.

It was the sec­ond-largest crypto hack ever, ac­cord­ing to an­a­lyt­ics firm El­lip­tic. The as­sets were worth about $540 mil­lion on the date of the theft and are worth about $615 mil­lion now.

Sky Mavis shared a link that shows the stolen funds are still in the hack­er’s wal­let. The firm said it is work­ing with the an­a­lyt­ics firm Chainal­y­sis to track the stolen funds. The news didn’t have a big im­pact on the price of ether, which was down 0.65% at $3,395.20 at 5 p.m. ET.

“We are work­ing di­rectly with var­i­ous gov­ern­ment agen­cies to en­sure the crim­i­nals get brought to jus­tice,” Ronin said in the state­ment. “We are in the process of dis­cussing with Axie In­fin­ity/Sky Mavis stake­hold­ers about how to best move for­ward and en­sure no users’ funds are lost.”

The hack comes as a blow to the crypto in­dus­try as it moves into the main­stream with Wall Street buy-in, celebrity en­dorsers and high-pro­file Su­per Bowl ads. The fed­eral gov­ern­ment is still weigh­ing fur­ther reg­u­la­tions of digi­tal as­sets.

“Axie In­fin­ity,” launched in 2018, is part of a small but fast-grow­ing num­ber of so-called play-to-earn games. Also known as blockchain games, they largely cen­ter on the buy­ing, trad­ing and sell­ing of vir­tual as­sets backed by non­fun­gi­ble to­kens, or NFTs. The games are con­sid­ered an early foray into the meta­verse, a more im­mer­sive fu­ture ver­sion of the in­ter­net where peo­ple are ex­pected to work, learn and be en­ter­tained.

“Axie In­fin­ity” had more than 1.7 mil­lion daily users in Feb­ruary, ac­cord­ing to Sky Mavis. In it play­ers col­lect digi­tal pets called Ax­ies that they use to com­pete in bat­tles. They can sell and trade the crea­tures for digi­tal cur­rency. Some Ax­ies are worth more than oth­ers.

Many de­vel­op­ers of earn-to-play games are star­tups, but some of the game in­dus­try’s large, pub­licly traded com­pa­nies have re­cently be­gun ex­per­i­ment­ing in the cat­e­gory, in­clud­ing “Far­m­Ville” maker Zynga Inc. and “As­sas­sin’s Creed” cre­ator Ubisoft En­ter­tain­ment SA.

Some in­dus­try ex­ec­u­tives have raised con­cerns about the se­cu­rity and value of NFTs in games, such as Mi­crosoft Corp. gam­ing chief Phil Spencer and the head of “Fort­nite” maker Epic Games Inc., Tim Sweeney. Many gamers also are skep­ti­cal of the trend and worry that earn-to-play merely rep­re­sents a cash-grab op­por­tu­nity for de­vel­op­ers.

The de­cen­tral­ized na­ture of crypto plat­forms, added with the oft­times in­ex­pe­ri­ence of the de­vel­op­ers of those plat­forms, leaves plenty of vul­ner­a­bil­i­ties in­side the code for hack­ers to ex­ploit. Since 2011, there have been 226 hack­ing in­ci­dents—not in­clud­ing the “Axie In­fin­ity” hack—that have led to the theft of $12.1 bil­lion, re­search firm Crys­tal Blockchain es­ti­mates.

In 2021, there were a record 75 in­ci­dents that re­sulted in $4.25 bil­lion be­ing stolen, ac­cord­ing to the firm. The largest crypto hack was in Au­gust 2021, when a DeFi pro­to­col called Poly­Net­work lost as­sets worth $611 mil­lion at the time of the hack.

One of the high­est-pro­file hacks was the 2016 break-in of Bitfinex, which re­sulted in a loss of about $70 mil­lion worth of bit­coin at the time. In Feb­ruary, FBI agents seized the ma­jor­ity of the stolen funds, which had surged to a value of about $3.6 bil­lion, and charged a Man­hat­tan cou­ple with laun­der­ing the stolen funds.