Cryptocurrency hack: US$615 million stolen from players of popular NFT game Axie Infinity

Two players playing Axie Infinity
The hack went undetected for six days, according to reports. Photo credit: Getty Images

Blockchain project Ronin has announced that hackers stole cryptocurrency now worth almost US$615 million ($NZ886 million) from its systems, in what would be one of the largest cryptocurrency heists on record.

The project said that on March 23, unidentified hackers stole some 173,600 ether tokens and 25.5 million USD Coin tokens. At current exchange rates, the stolen funds are worth US$615 million, but they were worth some US$540 million at the time of the attack.

This makes it the second-largest crypto theft on record, according to blockchain analysis firm Elliptic.

Ronin is used to power the popular online game Axie Infinity, which uses non-fungible tokens (NFTs) and is the biggest NFT collection by all-time sales volume, according to NFT market tracker CryptoSlam.

In a blog post the company said that the hacker had used stolen private keys - the passwords needed to access crypto funds - to make off with the funds.

Ronin said it had discovered the hack on Tuesday (local time). "We are working directly with various government agencies to ensure the criminals get brought to justice," it said, adding that it was discussing with Axie Infinity how to ensure no users' funds were lost.

Users are unable to withdraw or deposit funds on the network, it said.

Ronin is developed by Singapore-based game studio Sky Mavis, which owns Axie Infinity. Sky Mavis does not provide contact details on its website. It did not immediately respond to a request for comment sent via LinkedIn.

Twitter account web3isgreat, which keeps track of NFT and cryptocurrency scams and failures, highlighted the six-day gap between the hack taking place and the company knowing about the theft.

"One thing that must be emphasised: the Axie Infinity hack occurred on March 23," the account tweeted.

"Sky Mavis became aware of it this morning, March 29, after a report from a user having trouble withdrawing funds.

"The equivalent of US$625 million was missing for SIX DAYS before they realised it."

Ronin did not immediately respond to a request for comment sent via Twitter. It said it was working with major blockchain tracker Chainalysis to trace the stolen funds. Most of the funds are still in the hacker's digital wallet, Ronin said.

According to reports 6250 ether, worth just under NZ$31 million, have been transferred out of the account.

Hacks have long plagued crypto platforms.

The cryptocurrency arm of Jump Trading said last month it had restored more than US$320 million to crypto platform Wormhole after the decentralised finance site was hit with one of the largest crypto heists on record.

Last August, hackers behind likely the biggest ever digital coin heist returned nearly all of the US$610 million-plus they stole from the DeFi site Poly Network.

In 2018, digital tokens worth some US$530 million were stolen from Tokyo-based platform Coincheck. Mt. Gox, another Japanese exchange, collapsed in 2014 after hackers stole half a billion dollars of crypto.

Reuters / Newshub