‘Axie Infinity’ creator says stolen crypto worth $600m could take two years to recover

[ad_1]

The creator of the popular play-to-earn Axie Infinity cryptocurrency game said it expects to recover at least a portion of the roughly $600 million of cryptocurrencies that hackers looted from a software system linked to the game, while acknowledging that it may be a lengthy process.

“What we are assuming over the next two years is that some funds will be recovered,” Aleksander Leonard Larsen, chief operating officer of Ho Chi Minh-based Sky Mavis, said in an interview. “Two years for Axie is a good time for us to get more information. We’re here to play the long game.”

Sky Mavis is working with law enforcement agencies to locate and recover the tokens — mostly Ether — that were siphoned off by hackers in March from a blockchain “bridge” that allowed players to move cryptocurrencies into and out of the virtual world, Mr Larsen said. He declined to provide details on the investigation.

Besides raising money from investors to make players who lost funds whole, Sky Mavis will also take a $450m balance sheet hit to ensure all the stolen cryptocurrency is replenished.

Blockchain data shows that the stolen Ether tokens were deposited into Ethereum wallets, and some of the haul was then moved to Tornado Cash, a service that helps users mask transactions. Tornado’s technology breaks the link between the sender and receiver’s addresses on transactions sent to the Ethereum blockchain.

It’s “very rare” that funds stolen in large cryptocurrency hacks are fully recovered, according to Rishav Rai, lead investigator at Merkle Science, which specializes in such cases. At the same time, once a major hack has been discovered, it is difficult for the perpetrators to liquidate their loot.

Cryptocurrency mixers such as Tornado are not typically built to handle volumes of this magnitude, and moving the tokens through various exchanges and wallets “is not only expensive but time-consuming, not to mention extremely conspicuous”, Mr Rai said March 30.

The hackers gained access to five computers known as validator “nodes”, which allowed them to drain software known as the Ronin Bridge of 173,600 Ether and 25.5 million USDC tokens — worth about a combined $600m at current prices. To do so, they initially targeted a Sky Mavis employee in a so-called social engineering attack, Mr Larsen said.

“That person got access to our nodes through attacking one person on the team,” he said, without giving details. “The underlying technology for the Ronin network is still safe.”

What we are assuming over the next two years is that some funds will be recovered. Two years for Axie is a good time for us to get more information. We’re here to play the long game

Aleksander Leonard Larsen, chief operating officer of Sky Mavis

The company has said it does not suspect any insider involvement in the hack.

Sky Mavis has moved to fully compensate gamers who lost money in the attack. It raised $150m this week in a funding round led by Binance Holding to finance reimbursing users. That deal was wrapped up within 48 hours, Mr Larsen said, declining to comment on the valuation.

To make up the difference and fully replenish the cryptocurrency drained in the hack, Sky Mavis is also using $450m of its own money, Mr Larsen said.

The company remains in solid financial condition, he added. It has about $1.5 billion of cryptocurrencies in Axie Infinity’s treasury, where it parks fees paid by players for buying and minting the game’s blob-like non-fungible token characters. It will not tap the treasury funds to reimburse players.

Sky Mavis also struck an agreement with Binance which allows gamers to deposit and withdraw cryptocurrency even as the Ronin Bridge remains suspended. To bolster defenses against future attacks, the number of validators required to sign off on withdrawals from the bridge has been raised to 21.

Axie Infinity was losing users even before the hack. Data for the week ended March 28, a day before the theft was discovered, showed that the number had tumbled about 45 per cent from a peak in November, to 1.48 million. Mr Larsen attributed that largely to a steep drop in the value of the game’s rewards, which he said turned off players who participated purely to make money.

Updated: April 10, 2022, 4:30 AM

[ad_2]