‘Huge deficiency’: Crypto industry reels from $600 mn hack

PARIS: Investigators are on the trail of hackers who spirited away more than $600 million in cryptocurrency last week, watching the money as it moves around a system that critics call the Wild West of finance.

But they are playing catch-up: the gaming company that got scammed apparently did not even notice for six days.

The hack is one of the biggest to hit the crypto world, raising huge questions about security in an industry that only recently burst into the mainstream thanks to celebrity promotions and promises of untold wealth.

The sector has been beset by scams and hacks.

This week’s theft from the makers of Axie Infinity, a game where players can earn crypto through gameplay or trading their avatars, came just weeks after thieves made off with around $320 million in a similar attack.

“We are seeing more hacks because there is more money in blockchain,” said Roman Bieda of Coinfirm, a crypto-security company, referring to the technology that underpins cryptocurrencies.

The industry should have learned the lessons from previous attacks but security was still being sacrificed for profit, he added, labelling Axie’s failure to notice the hack a “huge deficiency”.

Refunds promised

The Axie Infinity attackers exploited weaknesses in the set-up put in place by the Vietnam-based firm behind the game, Sky Mavis.

The company had to solve a problem: the ethereum blockchain, where transactions in the ether cryptocurrency are logged, is relatively slow and expensive to use.

To allow Axie Infinity players to buy and sell at speed, the firm created an in-game currency and a sidechain with a bridge to the main ethereum blockchain.

The result was faster and cheaper — but ultimately less secure.

Hackers were able to take over the sidechain and empty its coffers apparently without anyone realising, something experts say would be all but impossible on the ethereum blockchain.

The firm said it would recover or reimburse the funds, easing the anxiety of gamers — particularly in the Philippines where hundreds of thousands play Axie Infinity.

“Some of the Philippine community right now are going crazy because of what happened,” Dominic Lumabi, a gamer from Manila, told AFP.

Some feared the game would close and money would be lost, he said, adding that he was relieved Sky Mavis was being transparent.

But the firm faces a tough challenge to get the money back.