Jack Kubinec

<div id="highlights-block_62bc42c09b064" class="highlights">
 <ul>
 <li>Few DeFi companies employ dedicated security personnel</li>
 <li>Industry experts believe bridges will become more secure as DeFi matures</li>
 </ul>
 
</div>



As investment in cryptocurrency grows, so does the incentive for criminal actors to exploit the DeFi (decentralized finance) space. Cross-chain bridge hacks have been the weapon of choice for crypto thieves in 2022. Bridge hacks have accounted for more than a billion dollars in stolen funds this year, according to research from blockchain analytics and compliance firm Elliptic.



Cross-chain bridges allow assets to be moved between different blockchain protocols, meaning the networks contain a large concentration of crypto assets. The recent string of bridge attacks has caused some industry leaders to question whether the benefits of bridges outweigh their risks. A top analyst at Elliptic believes bridge hacks are just growing pains that DeFi will eventually surmount.



<a href="https://cms.blockworks.co/defi-cross-chain-horizon-bridge-hacked-for-100m/" target="_blank" rel="noreferrer noopener">Harmony</a>, <a href="https://cms.blockworks.co/sky-mavis-ronin-network-bridge-exploited-for-over-600m/" target="_blank" rel="noreferrer noopener">Sky Mavis</a>, and <a href="https://cms.blockworks.co/in-second-largest-defi-hack-ever-blockchain-bridge-loses-320m-ether/" target="_blank" rel="noreferrer noopener">Wormhole</a> all suffered blockchain exploits exceeding $100 million this year. Mudit Gupta, Chief Information Security Officer at Polygon, believes bridge insecurity is an industry-wide problem.



“Most of the hacks are happening due to companies not having proper security experts and not knowing what to do themselves,” Gupta said in a Twitter DM. “There are very few DeFi companies with [dedicated] security personnel.”



DeFi protocols have proliferated rapidly in the past six years, but security infrastructure has not kept up with the now over-$900 billion industry. For this reason, hacks totaling in the hundreds of millions are not surprising.&nbsp;



On April 1, a trader tweeted their concern that a major Harmony Horizon Bridge exploit would only require a hacker to obtain two of the protocol’s five validator keys. In June, that exact scenario occurred — and Harmony was ransacked for $100 million.



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">Since the current narative du-jour is bridges &amp; bridge hacks, I wanted to do some digging on the harmony bridge on Ethereum which secures ~$330m worth of tokens.&mdash; Ape Dev (@_apedev) <a href="https://twitter.com/_apedev/status/1510007663832223751?ref_src=twsrc%5Etfw">April 1, 2022</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



Vitalik Buterin, co-founder of Ethereum, believes cross-chain bridges are inherently prone to security breaches.



“The fundamental security limits of bridges are actually a key reason why…I am pessimistic about cross-chain applications,” Buterin wrote in a lengthy January Reddit post. The influential founder went on to express his belief that assets should be held in the same blockchain ecosystem, rather than shuffled between chains.



Tara Annison, Head of Technical Crypto Advisory at the crypto research firm Elliptic, disagrees.



“We’re not going to live in a single chain world,” Annison said. It will always be necessary to move assets between blockchains, so “we shouldn’t characterize bridges in general as bad just because some have been hacked.”



Annison believes bridge hacks are caused by the concentration of value within cross-chain bridges, not by the bridges themselves.



<blockquote class="wp-block-quote is-layout-flow wp-block-quote-is-layout-flow">“If you think of wars, you try to bomb bridges to stop goods and services moving across,” Annison said. Recent cross-chain bridge hacks are not happening “because bridges are inherently weak infrastructure, it’s because they have a concentration of value.”</blockquote>



Annison believes that all crypto assets come with risk, and bridges are just the risk “flavor of the month” following stablecoins in May and NFTs before that. Bridges should become more secure as protocols become more technologically mature.



It remains to be seen if market participants agree.



Sky Mavis’ Ronin Bridge, which was compromised for $625 million in April, <a href="https://cms.blockworks.co/sky-mavis-reopening-ronin-bridge-with-enhanced-security/" target="_blank" rel="noreferrer noopener">reopened</a> this morning. Close to $9 million in assets have already left the chain, according to Messari.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/the-breakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha in your inbox. Think like an analyst. </li>
</ul>

Bridge

Cross-chain Bridge Thefts Top $1B in 2022

<div id="highlights-block_62b638fedca88" class="highlights">
 <ul>
 <li>The bridge will reopen on June 28th with more validators</li>
 <li>Sky Mavis raised $150 million in a funding round led by Binance to restore the stolen funds</li>
 </ul>
 
</div>



Barely three months after popular blockchain-based game Axie Infinity’s asset transfer protocol was breached for more than $500 million, the so-called crypto bridge is set to reopen.&nbsp;



The speedy reopening was aided by a Binance-led $150 million <a href="https://www.binance.com/en/blog/ecosystem/binance-leads-$150m-funding-round-of-sky-mavis-the-creator-of-axie-infinity-to-restore-funds-on-the-ronin-bridge-and-to-build-a-sustainable-global-ecosystem-421499824684903659" target="_blank" rel="noreferrer noopener">funding round</a> meant to help Sky Mavis reimburse users on the play-to-earn gaming platform. The company claims to have undergone multiple audits and upgraded its security since the March hack, but it remains to be seen whether users will trust Ronin with their funds again.



In the game, the largest based on non-fungible tokens (NFTs), players battle to earn tokens that can be exchanged for other currencies through the Ronin bridge. Players without access to Binance have been unable to withdraw their tokens since the hack and subsequent shutdown.



The hackers wrested control of the Ronin bridge’s validator nodes and stole 176,300 ether and 25.5 million USDC. The exploit was one of multiple recent transfer protocol hacks, with Wormhole and Horizon also suffering heists in the hundreds of millions this year.



“While racing for mainstream adoption, we made some trade-offs that ended up leaving us vulnerable to this sort of attack” Sky Mavis said in a blog post.



Following the funding round, Sky Mavis underwent an internal audit and two external audits. The company also pledged to increase its validator nodes from nine in-house operated validators to 21 more-decentralized validators. Binance CEO Changpeng Zhao is optimistic that enhanced security measures will restore belief in Sky Mavis.



“We have seen the tremendous work and growth of the Sky Mavis team since working together on the Axie Infinity project on Binance Launchpad,” Zhao said in a statement. “We strongly believe Sky Mavis will bring a lot of value and growth for the larger industry.”



Sky Mavis has promised to return all stolen user funds when it reopens the Ronin bridge on June 28. It remains unclear how many users will resume use of the product.&nbsp;



The Axie Infinity influencer “cloudwhite” told Blockworks he believes most gamers hoping to withdraw their funds from Axie have already found a way to do so. The remaining users should continue to use the Ronin bridge once it reopens.



“The good news is we’ll know which way things swing in less than a week,” cloudwhite said.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/the-breakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha in your inbox. Think like an analyst. </li>
</ul>

Axie Infinity

Following Hack, Sky Mavis Reopening Ronin Bridge With Enhanced Security

Macauley Peterson

<div id="highlights-block_625d93ec94215" class="highlights">
 <ul>
 <li>An attacker drained 24,830 ether and 36 million BEAN tokens worth about $180 million</li>
 <li>The attacker exploited a loophole in the protocol&#8217;s governance process to push through a malicious “improvement proposal”</li>
 </ul>
 
</div>



Beanstalk Farms, billed as “a decentralized credit based stablecoin protocol,” was exploited on Sunday for paper losses of about $180 million — the year’s latest DeFi hack.



That pegs it as the fifth-largest protocol exploit on the tracking site <a href="https://rekt.news/leaderboard/" target="_blank" rel="noreferrer noopener">Rekt Leaderboard</a> and the second largest this year after the massive <a href="https://cms.blockworks.co/axie-infinity-developers-made-some-trade-offs-that-enabled-625m-ronin-breach/" target="_blank" rel="noreferrer noopener">Ronin Bridge hack</a> in March. Security firm PeckShield <a href="https://twitter.com/peckshield/status/1515680335769456640" target="_blank" rel="noreferrer noopener">first reported</a> the news.



Like the Ronin exploit, most of the stolen funds consist of ether, which the attacker quickly began funneling into privacy protocol <a href="https://cms.blockworks.co/the-purpose-and-perils-of-crypto-privacy-tools/" target="_blank" rel="noreferrer noopener">Tornado Cash</a> in an effort to obscure the tokens&#8217; origin.



The group confirmed the exploit <a href="https://twitter.com/BeanstalkFarms/status/1515700678454390785?s=20&amp;t=6bBnLvTLeFj_ldavvVEpfw" target="_blank" rel="noreferrer noopener">on Twitter</a> Sunday and is now <a href="https://twitter.com/BeanstalkFarms/status/1515747114894065664?s=20&amp;t=6bBnLvTLeFj_ldavvVEpfw" target="_blank" rel="noreferrer noopener">considering</a> a path forward.



Beanstalk had recently celebrated a milestone, reaching $100 million in BEAN tokens minted. One BEAN was meant to be equal to one US dollar, but unlike stablecoins backed by fiat or crypto collateral, Beanstalk used a novel system of financial incentives to maintain its peg using credit rather than overcollateralization, according to its <a href="https://bean.money/docs/beanstalk.pdf" target="_blank" rel="noreferrer noopener">whitepaper</a>.



The protocol had undergone one audit from blockchain security expert Omniscia, but the firm indicated in a <a href="https://medium.com/@omniscia.io/beanstalk-farms-post-mortem-analysis-a0667ee0ca9d" target="_blank" rel="noreferrer noopener">post-mortem analysis</a> that the production code which suffered the exploit differed from what the firm had audited.



The developers disputed that account during a live <a href="https://anchor.fm/beanstalk-farms/episodes/Beanstalk-Exploit-Town-Hall---041722-e1hah60" target="_blank" rel="noreferrer noopener">town hall meeting</a> Sunday.



“We’re not in the business of pointing fingers [but] we did take a look at the report they published and didn’t feel that it was a genuine account of what occurred,” the lead developer said.



Omniscia pointed to a “flash-loan susceptible governance flaw” as the culprit, allowing the attacker to propose and then force through a malicious governance proposal that effectively withdrew all the protocol’s assets to the attacker’s wallet.



The trick was to use a massive flash-loan — borrowing vast sums that must be repaid within the same transaction — and circumvent the usual life cycle of a governance proposal. In a bit of DeFi magic using $1.04 billion in borrowed stablecoins, the attacker briefly acquired a supermajority of the protocol’s voting power, which was directed to immediately execute malicious code.



<blockquote class="wp-block-quote is-layout-flow wp-block-quote-is-layout-flow">“The Beanstalk Protocol supported protocol upgrades via its Beanstalk-Improvement-Proposal (BIP) governance mechanism and as such, it was possible for an upgrade to perform arbitrary code execution thus allowing the attacker to retrieve their locked funds as part of their malicious update,” Omniscia wrote.</blockquote>



A 24-hour waiting period was in effect, but the offending BIP was disguised as a bid to donate funds to support Ukraine and passed the delay period before a supermajority vote would be effective.



“We thought it was very strange, but we obviously were not aware of what was going on, what attack was in progress,” the developers explained during the town hall.



<blockquote class="wp-block-quote is-layout-flow wp-block-quote-is-layout-flow">“We’re going to do everything we can to find out who did this and bring them to justice.”</blockquote>



Following the exploit, the protocol‘s BEAN tokens immediately dropped in value by 90% and effectively all its other assets, including those deployed by the attacker, were liquidated, resulting in a net profit of about $75 million in ether and other tokens.



<div class="wp-block-image"><figure class="aligncenter"><img decoding="async" src="https://lh3.googleusercontent.com/IC5hTLOpqEPk574b_XTJLDGu-geLQH_8TYAV4l_mGJtjX9wAYm6stnlNCvL7TZx34Qcv8BsUeODOHE4wN-Ntqy192VgWq8PgXjrFfaZcfE3X7DsjyX9n7nVVJ-ROm5Zk96epLkEY" alt=""/><figcaption>According to Beanstalk&#8217;s developers, &#8220;the existing [BEAN] should not be bought or traded as >33% of Beans are still in the exploiter&#8217;s custody. Given that the Bean token is not upgradable and has no blacklist capabilities, there is no way to remove these Beans from the exploiter&#8217;s custody. Thus, a new Bean ERC-20 token will need to be issued during a restart.&#8221;</figcaption></figure></div>



According to PeckShield, the hacker sent $250,000 of USDC to an address in support of Ukraine. 



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">4/ The initial funds to launch the hack are withdrawn from <a href="https://twitter.com/SynapseProtocol?ref_src=twsrc%5Etfw">@SynapseProtocol</a> and most of the result gains are deposited to <a href="https://twitter.com/TornadoCash?ref_src=twsrc%5Etfw">@TornadoCash</a>. Currently 15,154 ETH still stays in the hacker’s account. Note the hacker donates 250k USDC to Ukraine Crypto Donation. <a href="https://t.co/jBjUJ0JbGj">pic.twitter.com/jBjUJ0JbGj</a>&mdash; PeckShield Inc. (@peckshield) <a href="https://twitter.com/peckshield/status/1515693348815790081?ref_src=twsrc%5Etfw">April 17, 2022</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



<h3 class="wp-block-heading">Seeds of hope</h3>



Despite the catastrophe, the protocol’s developers have pledged to continue work on the project.



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">Today is a bad day, but it is not the end. We have been blown away by the show of the support from our community this am. The path forward is unclear, but the destination has never been clearer.&mdash; publius (@isthispublius) <a href="https://twitter.com/isthispublius/status/1515728000247123971?ref_src=twsrc%5Etfw">April 17, 2022</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



During the town hall and on <a href="https://discord.gg/beanstalk" target="_blank" rel="noreferrer noopener">the group’s Discord</a>, the pseudonymous team took the extraordinary step of revealing their identities and explained their intention to cooperate with law enforcement in the hope of identifying the attacker and recovering funds.



<div class="wp-block-image"><figure class="aligncenter"><img decoding="async" src="https://lh5.googleusercontent.com/_x64Yh0o5hCr1ejvZ4riFBU9v2HabC8-scfHnu4gxd10EbaJTil4UmKGDfLPVEb6gP3sJRx_1X5pwjPY0Xa1SmVB9YJfBgCAd9CGj5CfW4x0o4hzjyysefYLuCbtcHYUHk1rYnzu" alt=""/></figure></div>



This is not the first time flash-loans have been deployed in a DeFi exploit. Last year, <a href="https://cms.blockworks.co/flash-loan-exploit-whips-cream-finance-for-130-million/" target="_blank" rel="noreferrer noopener">Cream Finance was robbed</a> of $130 million. That led its governance token CREAM to plummet by 70% — from which it has never recovered.



Unlike other high-value hacks, such as the <a href="https://cms.blockworks.co/wormhole-parent-commits-320m-ether-to-replace-massive-defi-hack-losses/" target="_blank" rel="noreferrer noopener">Solana Wormhole bridge exploit</a>, Beanstalk has no venture capital backing that could potentially provide a bailout to recapitalize the system.



The Beanstalk team did not immediately return a request for comment Monday.



In a follow-up <a href="https://bean.money/blog/beanstalk-governance-exploit" target="_blank" rel="noreferrer noopener">blog post</a> on Tuesday, the Beanstalk Farms team identified four &#8220;primary goals&#8221; for the project: &#8220;securing the enduring success of Beanstalk&#8217;s economic model; attracting sufficient capital to restart Beanstalk; preserving as much of each Farmers&#8217; Stalk, Seed and Pod positions as possible, and; aligning new capital with previous Stalk and Pod holders.&#8221;



This story was updated on April 19 and 5:00 am ET.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/the-breakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha in your inbox. Think like an analyst. </li>
</ul>

BEAN

Algo Stablecoin Protocol Beanstalk Cut Down by Governance Hijack

<div id="highlights-block_6259a583bdb9a" class="highlights">
 <ul>
 <li>The Tornado Cash front-end website will prevent access from OFAC-sanctioned wallet addresses</li>
 <li>The immutable smart contracts underpinning the mixing service remain unchanged, and therefore function the same as before</li>
 </ul>
 
</div>



The privacy tool Tornado Cash, which <a href="https://cms.blockworks.co/the-purpose-and-perils-of-crypto-privacy-tools/" target="_blank" rel="noreferrer noopener">has been used</a> to obfuscate the proceeds of multiple frauds, scams and hacks in the past, updated its web front-end on Friday to limit access from wallet addresses sanctioned by the US Treasury’s Office of Foreign Assets Control (OFAC).



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">Tornado Cash uses <a href="https://twitter.com/chainalysis?ref_src=twsrc%5Etfw">@chainalysis</a> oracle contract to block OFAC sanctioned addresses from accessing the dapp. Maintaining financial privacy is essential to preserving our freedom, however, it should not come at the cost of non-compliance.<a href="https://t.co/tzZe7bVjZt">https://t.co/tzZe7bVjZt</a>&mdash; 🌪️ Tornado.cash 🌪️ (@TornadoCash) <a href="https://twitter.com/TornadoCash/status/1514904975037669386?ref_src=twsrc%5Etfw">April 15, 2022</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>
</div></figure>



The move follows an <a href="https://cms.blockworks.co/treasury-sanctions-north-korean-hacker-group-confirms-ties-to-625m-hack/" target="_blank" rel="noreferrer noopener">update from OFAC</a> yesterday, which identified the wallet known to have received the funds <a href="https://cms.blockworks.co/sky-mavis-ronin-network-bridge-exploited-for-over-600m/" target="_blank" rel="noreferrer noopener">stolen from the Ronin Bridge</a> last month as controlled by the North Korean hacking organization Lazarus Group. The wallet still contains 144,000 of the original 173,000 ether, worth about $439 million as of Friday at 1:30 pm ET.



The change to Tornado Cash’s decentralized application (dapp) has no impact on the underlying privacy protocols’ code — a set of smart contracts on Ethereum meant to bring some measure of privacy to transactions on the transparent public blockchain network.



Understanding the difference between a protocol and a website that adds ease-of-use is not always easy for newcomers to Web3, as evidenced by the recent Uniswap class action lawsuit.



In the Web2 world of Google and Facebook, a website runs on a server owned by a company that exists in some country’s jurisdiction. In the case of Tornado Cash, the smart contract code runs on public Ethereum and cannot be changed, <a href="https://docs.tornado.cash/general/readme" target="_blank" rel="noreferrer noopener">the project’s documentation explains</a>.



<blockquote class="wp-block-quote is-layout-flow wp-block-quote-is-layout-flow">“Nobody — including the original developers — can modify or shut them down,” the documentation says.</blockquote>



The service is <a href="https://twitter.com/TornadoCash/status/1213660104743981058?s=20&amp;t=UdLudtsYp9VJMT81HALbZA" target="_blank" rel="noreferrer noopener">even accessible</a> from decentralized storage infrastructure known as IPFS rather than on any particular centralized web server.



<h3 class="wp-block-heading">So, what does this mean for the hackers?</h3>



The main user interface to Tornado Cash is an application that implements a <a href="https://etherscan.io/address/0x40c57923924b5c5c5455c48d93317139addac8fb" target="_blank" rel="noreferrer noopener">Chainalysis sanctions oracle</a> — basically a blacklist of Ethereum addresses maintained by the blockchain data platform Chainalysis. The address used in the Ronin hack has been added to that list.



But the Tornado Cash protocol itself can still be used as before, using an alternative front-end user interface. That doesn’t mean it can be used successfully to obscure the origins of the ether stolen in the Ronin bridge exploit, however.



Chainalysis co-founder Jonathan Levin has touted the firm’s ability to unmask transactions from mixers like Tornado Cash, especially when they contain large amounts of value relative to the total liquidity available.



“The fact that all of the industry and all of law enforcement and the regulatory authorities can all have access to that same information about what services and what entities are behind these transactions, that allows us to take unprecedented steps in being able to collaborate on weeding out illicit activity,” Levin <a href="https://cms.blockworks.co/impossible-for-russia-to-evade-sanctions-with-crypto-fincen-rep-says/" target="_blank" rel="noreferrer noopener">told a Senate panel</a> in March.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/the-breakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha in your inbox. Think like an analyst. </li>
</ul>

chainalysis

Tornado Cash Spins Up Sanctions-compliant Web Interface

Morgan Chittum

<div id="highlights-block_62432ab13c83b" class="highlights">
 <ul>
 <li>Exploiters used hacked private keys to forge fake withdrawals on March 23</li>
 <li>“We are working with law enforcement officials, forensic cryptographers, and our investors to make sure that all funds are recovered or reimbursed,” Ronin Network said in a statement</li>
 </ul>
 
</div>



Ronin Network, an Ethereum-linked sidechain used for blockchain game Axie Infinity, was breached. Hackers exploited the network for roughly $625 million, or <a href="https://etherscan.io/address/0x098b716b8aaf21512996dc57eb0615e2383e2f96" target="_blank" rel="noreferrer noopener">173,600 ether</a> and 25.5 million USDC, according to a Tuesday <a href="https://roninblockchain.substack.com/p/community-alert-ronin-validators?s=w" target="_blank" rel="noreferrer noopener">statement</a>.



Exploiters, per the network’s post, used hacked private keys to forge withdrawals on March 23. The breach, however, wasn’t discovered until Tuesday, when a user was unable to withdraw 5,000 ETH.



Ethereum and USDC deposits on Ronin have been drained from its bridge contract. Users, as of now, are unable to withdraw or deposit funds. The Ronin Bridge and Katana DEX, as a result, have been halted.



“Sky Mavis’ Ronin chain currently consists of 9 validator nodes. In order to recognize a Deposit event or a Withdrawal event, five out of the nine validator signatures are needed,” the blogpost said. “The attacker managed to get control over Sky Mavis’s four Ronin Validators and a third-party validator run by Axie DAO.”



<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter"><div class="wp-block-embed__wrapper">
<blockquote class="twitter-tweet" data-width="550" data-dnt="true">There has been a security breach on the Ronin Network.<a href="https://t.co/ktAp9w5qpP">https://t.co/ktAp9w5qpP</a>&mdash; Ronin (@Ronin_Network) <a href="https://twitter.com/Ronin_Network/status/1508828719711879168?ref_src=twsrc%5Etfw">March 29, 2022</a></blockquote><script async src="https://platform.twitter.com/widgets.js" charset="utf-8"></script> 
</div></figure>



Sky Mavis, the creator of Axie Infinity, said it is “committed to ensuring that all of the drained funds are recovered or reimbursed.”



“We are working with law enforcement officials, forensic cryptographers, and our investors to make sure that all funds are recovered or reimbursed,” the network said in a tweet.&nbsp;



Most of the stolen ETH remains in the attacker’s wallet, but 6,250 ETH (about $21 million) has been transferred out, including hundreds of ETH sent to the FTX Exchange.



All $25.5 million in USDC has been transferred out to various wallets and DeFi protocols, according to <a href="https://etherscan.io/address/0x098b716b8aaf21512996dc57eb0615e2383e2f96" target="_blank" rel="noreferrer noopener">Etherscan</a>.



RON, the native token of the Ronin Network, is down 23% on the news, according to <a href="https://coinmarketcap.com/currencies/ronin/" target="_blank" rel="noreferrer noopener">CoinMarketCap</a>.



This is a developing story and may be updated as new information becomes available.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/the-breakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha in your inbox. Think like an analyst. </li>
</ul>