Published on: 07/04/2022

Sky Mavis raises $150M to reimburse NFT game Axie Infinity hacker attack victim

Axie Infinity developer Sky Mavis announced that they raised $150 million to enhance security measures and reimburse their players who fell victim to a hacker attack in late March, which resulted in a $625 million loss. It was reported that the earn-to-play game experienced a mass abandonment after the attack after players found themselves unable to access gaming proceeds.

The funding was led by the world’s largest cryptocurrency exchange, Binance, whose trading platforms are used for digital token trading activities by Axie Infinity. Other investors include gaming and blockchain company Animoca Brands as well as venture capital firms Andreessen Horowitz, Dialectic, and Paradigm, Sky mavis announced Wednesday.

“Sky Mavis is committed to reimbursing all of our users’ lost funds and implementing rigorous internal security measures to prevent future attacks,” Sky Mavis chief executive Trung Nguyen said in a statement.

The attack

It was announced in late March that an unidentified hacker stole $625 million worth of cryptocurrency from Ronin, the blockchain underlying Axie Infinity. Vietnam-based Sky Mavis said it froze transactions on the Ronin bridge following the incident.

The company said it was working with law enforcement to recover $600 million worth of Ethereum and 25.5 million worth of US dollar-pegged cryptocurrency USDC. The hacker withdrew the assets on March 23rd after launching an attack on the bridge to Sky Mavis’ Ronin blockchain, which acts as an intermediary between Axie Infinity and other cryptocurrency blockchains, including Ethereum.

Sky Mavis said the hacker compromises the network nodes that validate transfers to and from Ronin by using hacked private security keys, allowing the attacker to withdraw a huge amount of Ethereum and USDC quietly. The transfer was discovered almost one week after the incident after a user made a withdrawal attempt of 5,000 Ethereum through the bridge.

Despite the incident, the Axie NFT tokens that players must purchase in order to play Axie Infinity were unaffected. The same applies to the SLP and AXS in-game cryptocurrencies, which are used in battling and breeding in-game creatures.

However, many new players have been locked out of the game due to the freezing of withdrawals and deposits. The incident also led many players to question the safety of their assets stored in the blockchain. Sky Mavis, meanwhile, said it was “working with law enforcement officials, forensic cryptographers, and our investors to make sure there is no loss of user funds”, adding that it was its “top priority”.

Sky Mavis blamed the attack on a shortcut the company took in November 2021 to relieve an “immense user load” on its network due to Axie Infinity gaining sudden popularity in the Philippines and other countries, with players relying on the game as their main source of income.

The developer also said that if the stolen funds cannot be retrieved or recovered within two years, a vote will take place to decide the next steps for the Axie DAO. They also reported that they were increasing the number of validators that handle transactions from five to 21 to improve the game’s security.