North Korea, NFTs and a hit video game: inside a $500m cryptocurrency theft

theguardian.com:

Late last month, hackers made off with what was then worth more than $500m from the systems of cryptocurrency network Ronin, in what is believed to be the second-largest cryptocurrency theft on record.

Ronin was a juicy target for a hacker. The blockchain project supports the wildly popular Axie Infinity video game, which with an estimated 8 million players has drawn comparisons to action-driven collecting games like Pokémon Go.

Axie Infinity is hot and involves substantial sums of money. Players purchase creatures called Axies in the form of NFTs, unique digital assets known as non-fungible tokens. The creatures can breed, battle and even be exchanged for cold, hard cash.

The game has swelled in popularity as players see the potential to earn real money. In 2020, one 22-year-old player from the Philippines reportedly bought two apartments in Manila with his earnings from the game. Last year, another player said he earned more through Axie Infinity and other online games than from his full-time job at Goldman Sachs.

But the underpinnings of the game face significant security challenges. To play, gamers must move their money from Ethereum to Ronin on a blockchain “bridge” system. Ronin is a “sidechain” of Ethereum – a scaling solution that allows transactions to happen faster than on Ethereum, which is congested by the amount of activity it hosts. Hosting the game on this sidechain ensures it can grow without losing functionality. Bridges can hold a lot of money at once, so by targeting the Ronin Bridge that transferred players’ assets between blockchains, hackers seized control of the assets and took off with the money.

The US government said this week it believes North Korean hackers are behind the heist. But it’s just the