Incident
incident:axie_infinity
Also: Axie Infinity Ronin Bridge hack
The cryptocurrency theft involving the Ronin Bridge and approximately $625 million in ETH and USDC.
The cryptocurrency theft involving the Ronin Bridge and approximately $625 million in ETH and USDC.
“Axie Infinity’s Ronin Bridge hacked; $625 million stolen.”
“They stole ETH, ETH currency, and USDC, which at the time was valued at $625 million.”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | TARGETS | Sky Mavis | Explicit | 147 |
| outgoing | INITIAL_ACCESS_VIA | social engineering | Explicit | 147 |
| outgoing | COMPROMISES | Ronin Bridge | Explicit | 147 |
| outgoing | INVOLVES | Ethereum | Explicit | 147 |
| outgoing | ATTRIBUTED_TO | North Korea | Uncertain | 147 |
| outgoing | USES | Tornado Cash | Explicit | 147 |
Axie Infinity TARGETS Sky Mavis
The hackers targeted an engineering employee of Sky Mavis and gained deep-level access to its systems.
Explicit Confidence 99% · Geoff White EP 147 Details
“the hackers targeted one of the engineering team”
“the malware allowed the hackers access to Sky Mavis’ computer systems”
Axie Infinity INITIAL_ACCESS_VIA social engineering
The reported initial compromise involved an elaborate social-engineering job offer aimed at a Sky Mavis engineer.
Explicit Confidence 98% · Geoff White EP 147 Details
“carried out a very, very elaborate — or at least in my opinion, very elaborate social engineering exercise on this person; offered them a job”
Axie Infinity COMPROMISES Ronin Bridge
The hackers obtained control of enough Ronin validators to control the Ronin Bridge and transfer funds.
Explicit Confidence 99% · Geoff White EP 147 Details
“If they can control the Ronin Bridge, they can effectively control the flow of money”
“We control the bridge, we control the money, and it’s time to steal”
Axie Infinity INVOLVES Ethereum
The theft transferred ETH and USDC from the Ronin Bridge into Ethereum wallets.
Explicit Confidence 98% · Geoff White EP 147 Details
“They stole ETH, ETH currency, and USDC, which at the time was valued at $625 million”
Axie Infinity ATTRIBUTED_TO North Korea
The Axie Infinity hack was attributed to North Korea, but Geoff explicitly presents this as an allegation and North Korea denies involvement.
Uncertain Confidence 93% · Geoff White EP 147 Details
“very quickly, the name that pops into the frame is North Korea”
“these are allegations. North Korea denies these allegations”
Axie Infinity USES Tornado Cash
The thieves who stole funds from Axie Infinity sent hundreds of millions of dollars through Tornado Cash to launder or obscure its origin.
Explicit Confidence 99% · Jack Rhysider EP 147 Details
“The people who stole the $600 million from Axie Infinity also noticed Tornado Cash and sent hundreds of millions of dollars to it”