Hackers steal $US540m in crypto from ‘Axie Infinity’ game

A cryptocurrency start-up has had $719m stolen, one of the largest in the sector’s 13-year history.

An illustration picture taken in London on December 30, 2021, shows gold plated souvenir cryptocurrency coins arranged by a screen displaying a Crypto.com NFT (Non-Fungible Token) marketplace. - Non-fungible tokens or NFTs are cryptographic assets stored on a blockchain with unique identification metadata that distinguish them from each other. (Photo by Justin TALLIS / AFP)

A cryptocurrency start-up that operates a popular online game called “Axie Infinity” said Tuesday that hackers stole more than $US500m ($US719m) worth of cryptocurrency.

“Axie Infinity” publisher Sky Mavis said on March 23, hackers infiltrated a part of its Ronin Network, which the game runs on. The infiltrators got access to accounts holding cryptocurrencies and drained 173,600 ether and 25.5 million of the stablecoin USDC.

“The breach happened due to social engineering, not technical flaw,” said Aleksander Larsen, operating chief and co-founder of Sky Mavis. While users are now unable to withdraw or deposit funds to Ronin Network, he said Sky Mavis is committed to ensuring that all of the drained funds are recovered or reimbursed.

It was the second-largest crypto hack ever, according to analytics firm Elliptic. The assets were worth about $US540m on the date of the theft and are worth about $US615m now.

Sky Mavis shared a link that shows the stolen funds are still in the hacker’s wallet. The firm said it is working with the analytics firm Chainalysis to track the stolen funds. The news didn’t have a big impact on the price of ether, which was down 0.65 per cent at $US3,395.20 at 5pm ET.

“We are working directly with various government agencies to ensure the criminals get brought to justice,” Ronin said in the statement.

“We are in the process of discussing with Axie Infinity/Sky Mavis stakeholders about how to best move forward and ensure no users’ funds are lost.” The hack comes as a blow to the crypto industry as it moves into the mainstream with Wall Street buy-in, celebrity endorsers and high-profile Super Bowl ads. The federal government is still weighing further regulations of digital assets.

“Axie Infinity,” launched in 2018, is part of a small but fast-growing number of so-called play-to-earn games. Also known as blockchain games, they largely centre on the buying, trading and selling of virtual assets backed by nonfungible tokens, or NFTs. The games are considered an early foray into the metaverse, a more immersive future version of the internet where people are expected to work, learn and be entertained.

“Axie Infinity” had more than 1.7 million daily users in February, according to Sky Mavis. In it players collect digital pets called Axies that they use to compete in battles. They can sell and trade the creatures for digital currency. Some Axies are worth more than others.

Many developers of earn-to-play games are start-ups, but some of the game industry’s large, publicly traded companies have recently begun experimenting in the category, including “FarmVille” maker Zynga and “Assassin’s Creed” creator Ubisoft Entertainment.

Some industry executives have raised concerns about the security and value of NFTs in games, such as Microsoft gaming chief Phil Spencer and the head of “Fortnite” maker Epic Games, Tim Sweeney. Many gamers also are sceptical of the trend and worry that earn-to-play merely represents a cash-grab opportunity for developers.

The decentralised nature of crypto platforms, added with the ofttimes inexperience of the developers of those platforms, leaves plenty of vulnerabilities inside the code for hackers to exploit. Since 2011, there have been 226 hacking incidents – not including the “Axie Infinity” hack – that have led to the theft of $US12.1bn, research firm Crystal Blockchain estimates.

In 2021, there were a record 75 incidents that resulted in $US4.25bn being stolen, according to the firm. The largest crypto hack was in August 2021, when a DeFi protocol called PolyNetwork lost assets worth $US611m at the time of the hack.

One of the highest-profile hacks was the 2016 break-in of Bitfinex, which resulted in a loss of about $US70m worth of bitcoin at the time. In February, FBI agents seized the majority of the stolen funds, which had surged to a value of about $US3.6bn, and charged a Manhattan couple with laundering the stolen funds.

The Wall Street Journal