Incident
incident:axie_infinity_cryptocurrency_theft
Also: Axie Infinity theft
A March 2022 intrusion in which a crypto company was reported to have lost $540 million in cryptocurrency after a job-offer and malware-based intrusion.
A March 2022 intrusion in which a crypto company was reported to have lost $540 million in cryptocurrency after a job-offer and malware-based intrusion.
“someone broke into a crypto company, Axie Infinity, and stole $540 million worth of cryptocurrency”
“This was attributed to be the work of the government of North Korea.”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | ATTRIBUTED_TO | government of North Korea | Attributed | 122 |
| outgoing | TARGETS | Axie Infinity | Explicit | 122 |
| outgoing | INITIAL_ACCESS_VIA | Attributed | 122 | |
| outgoing | INVOLVES | social engineering | Explicit | 122 |
| outgoing | INVOLVES | Malware | Attributed | 122 |
Axie Infinity cryptocurrency theft ATTRIBUTED_TO government of North Korea
Jack says the theft was attributed to the government of North Korea.
Attributed Confidence 98% · Jack Rhysider EP 122 Details
“This was attributed to be the work of the government of North Korea”
Axie Infinity cryptocurrency theft TARGETS Axie Infinity
The attackers targeted people who worked at Axie Infinity in order to gain access to the company network.
Explicit Confidence 98% · Jack Rhysider EP 122 Details
“They targeted people who worked at Axie Infinity”
Axie Infinity cryptocurrency theft INITIAL_ACCESS_VIA LinkedIn
Jack says the attackers got into Axie Infinity through LinkedIn by enticing employees with job offers.
Attributed Confidence 97% · Jack Rhysider EP 122 Details
“the way they got in was through LinkedIn”
Axie Infinity cryptocurrency theft INVOLVES social engineering
The Axie Infinity attack involved enticing employees with job offers and manipulating them into opening a document.
Explicit Confidence 97% · Jack Rhysider EP 122 Details
“enticed them with great job offers”
Axie Infinity cryptocurrency theft INVOLVES Malware
Jack says opening the document placed malware on an employee's work computer and gave the attackers network access.
Attributed Confidence 98% · Jack Rhysider EP 122 Details
“when the employee opened the document, malware was put on their work computer”