{"id":64047,"date":"2022-07-07T09:16:46","date_gmt":"2022-07-07T06:16:46","guid":{"rendered":"https:\/\/forklog.com\/en\/?p=64047"},"modified":"2025-09-06T12:12:04","modified_gmt":"2025-09-06T09:12:04","slug":"spyware-used-in-ronin-attack-reports-say","status":"publish","type":"post","link":"https:\/\/forklog.com\/en\/spyware-used-in-ronin-attack-reports-say\/","title":{"rendered":"Spyware used in Ronin attack, reports say."},"content":{"rendered":"<p>Hackers were able to carry out the attack on the Ronin sidechain thanks to spyware in a PDF document that one of the employees downloaded from a job-offer email from a fictitious company. <a href=\"https:\/\/www.theblock.co\/post\/156038\/how-a-fake-job-offer-took-down-the-worlds-most-popular-crypto-game\">The Block<\/a> reports, citing sources familiar with the matter.<\/p>\n<p>According to Sky Mavis, which develops the blockchain game <a href=\"https:\/\/forklog.com\/en\/news\/what-is-axie-infinity-axs\">Axie Infinity<\/a>, employees were sent offers from a fake company via LinkedIn.<\/p>\n<p>One of the engineers responded to the vacancy. After a series of interviews, he was sent a document with an &#8216;offer&#8217; in PDF form. The document contained malware that compromised the Ronin network.<\/p>\n<p>Subsequently, the attackers were able to take control of four of the nine validators. Access to the fifth was obtained through <a href=\"https:\/\/forklog.com\/en\/news\/ronin-sidechain-developers-reveal-further-details-of-625-million-hack\">Axie DAO<\/a>.<\/p>\n<p>The Ronin sidechain used by Axie Infinity was attacked in March. The attackers drained crypto assets worth about $625 million. The breach was the largest in the history of the DeFi sector.<\/p>\n<p>Later, the project team said that the attackers used social engineering to access the assets.<\/p>\n<p>In June, the developers <a href=\"https:\/\/forklog.com\/en\/news\/ronin-sidechain-relaunches-three-months-after-625-million-hack\">restarted the Ronin sidechain<\/a> and reimbursed users for the funds they lost as a result of the March breach.<\/p>\n<p>For more about Ronin and its restart, read in <a href=\"https:\/\/forklog.com\/en\/news\/ronin-sidechain-relaunch-what-happened\">ForkLog cards<\/a>.<\/p>\n<p>Follow ForkLog&#8217;s bitcoin news in our <a href=\"\/\/telegram.me\/forklog\" target=\"\u201c_blank\u201d\" rel=\"\u201cnofollow\u201d noopener\">Telegram<\/a> \u2014 cryptocurrency news, prices and analytics.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Hackers were able to carry out the attack on the Ronin sidechain thanks to spyware in a PDF document that one of the employees downloaded from a job-offer email from a fictitious company. The Block reports, citing sources familiar with the matter.<\/p>\n","protected":false},"author":1,"featured_media":64048,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"select":"1","news_style_id":"1","cryptorium_level":"","_short_excerpt_text":"","creation_source":"","_metatest_mainpost_news_update":false,"footnotes":""},"categories":[3],"tags":[1581,1154,1359],"class_list":["post-64047","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news-and-analysis","tag-axie-infinity","tag-crimes","tag-ronin"],"aioseo_notices":[],"amp_enabled":true,"views":"19","promo_type":"1","layout_type":"1","short_excerpt":"","is_update":"","_links":{"self":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/64047","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/comments?post=64047"}],"version-history":[{"count":1,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/64047\/revisions"}],"predecessor-version":[{"id":64049,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/64047\/revisions\/64049"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/media\/64048"}],"wp:attachment":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/media?parent=64047"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/categories?post=64047"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/tags?post=64047"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}