Axie Infinity team reveals Ronin attack details and promises to reimburse users’ losses

The Sky Mavis company behind the Axie Infinity blockchain game has promised to compensate users who lost assets in the Ronin sidechain attack. The team said that the attackers used social engineering to gain unauthorized access to the assets.

3/ We are committed to ensuring that all of the drained funds are recovered or reimbursed.

— Ronin (@Ronin_Network) March 30, 2022

“We are confident that this was external interference. All evidence indicates that the attack was carried out using social engineering rather than technical flaws,” the statement said. 

Sky Mavis also said that the project team is working with Chainalysis to track the stolen funds. CrowdStrike is conducting a technical audit of Ronin to ensure there are no exploits. 

The Chief Operating Officer of Axie Infinity and Sky Mavis, Alexander Larsen, clarified that the attackers carried out the attack as early as December 2021. He said that to increase decentralisation of the sidechain the team will add several new validators. 

2/4

This was a social engineering attack combined with a human error from December 2021. @SkyMavisHQ tech is solid and we will be adding several new validators to @Ronin_Network shortly to further decentralize the network.

— Psycheout — Aleksander | Axie Infinity (@Psycheout86) March 30, 2022

“We aim to return or reimburse all withdrawn assets and we continue negotiations with interested parties to determine the best course of action,” he added.

Ronin had previously been criticised for excessive centralisation — the sidechain is governed by just nine validators. Analyst Mikko Ohtamaa compared the project to a CEX.

If 5 out of 9 nodes got compromised in one go, Ronin was not a decentralised network, but equal to a centralised service like CEX https://t.co/JzujPaiGjM pic.twitter.com/gsz7u3EjwJ

— Mikko Ohtamaa 🐮 (@moo9000) March 29, 2022

In a discussion with Bloomberg, Larsen noted that the funds stolen from Ronin included “player and speculator deposits, as well as the treasury of Axie Infinity.” The latter accounted for 56,000 ETH of the 173,600 ETH stolen. 

The project’s COO emphasised that Sky Mavis has ruled out an insider attack. 

As a reminder, the Ronin attack on March 23 saw attackers withdraw from the sidechain crypto assets with a total value of about $625 million. The incident was the largest theft in the history of the DeFi sector. 

Follow ForkLog’s Bitcoin news on our Telegram — crypto news, prices and analysis.