Ronin Network Hack: White Hat or Black Hat Hackers Target the NFT Game Network

In the crypto space, the lines between malicious actors and others can sometimes be blurred. This is seen in the case of Ronin Network, a blockchain powering the NFT game Axie Infinity, which recently suffered a major breach.

Blockchain technology has advanced rapidly in recent years, introducing new possibilities and challenges in the realm of finance and digital assets. As the crypto space continues to expand, so too does the need for vigilance against malicious actors attempting to exploit vulnerabilities.

Recently, the Ronin Network, a blockchain powering the NFT game Axie Infinity, encountered a potential $12 million exploit, prompting the network to shut down its bridge operations. However, as the dust settles, a gray area emerges, leaving us to question the true nature of the hackers' actions.

In the early hours of Tuesday, August 6, the Ronin Network detected an exploit resulting in the loss of 3,996 ETH, valued at approximately $9.8 million. Blockchain security firm PeckShield was among the first to report the suspicious transaction on social media, which prompted Ronin to immediately halt its bridge operations. The network’s co-founder, Aleksander Larsen, later confirmed the shutdown.

#PeckShieldAlert @Ronin_Network whitehacked? or Hacked? (w/ ~ $9.33M) pic.twitter.com/wfaY0zhVdI

According to the Ronin Network team, the exploit was linked to a recent bridge upgrade that introduced an issue misinterpreting the required vote threshold for fund withdrawals. This vulnerability allowed the maximum allowable amount to be withdrawn in a single transaction, which the hackers proceeded to do. They withdrew approximately 4,000 Ether (ETH) and 2 million USDC, valued at about $12 million.

Earlier today, we were notified by white-hats about a potential exploit on the Ronin bridge. After verifying the reports, the bridge was paused approximately 40 minutes after the first on-chain action was spotted.

The actors withdrew ~4K ETH and 2M USDC, valued at ~$12M, which…

The team, however, reported that the attackers appear to be “white hat” hackers rather than malicious actors, and they are currently negotiating with them to return the funds. White hat hackers typically use hacking to uncover vulnerabilities and help improve network security. They then return the seized funds to the owners, often keeping a reward. In many cases, they receive immunity for their action.

The latest hack comes after Ronin suffered a $9.7 million hack in February. In that incident, attackers routed 3,248 ETH through a crypto mixer, Tornado Cash, which is used to obscure the origins of the funds. The use of mixers was a clear indication that whoever was behind the hack was a malicious actor.

So far in the latest hack, the attackers have not moved the funds to separate wallets or attempted to interact with exchanges or mixers. Still, without direct insight into their intent, it can be difficult to distinguish between white hat and black hat hackers. Ultimately, before the hackers return the funds, there is no way to definitively say what their intentions were.

On the Flipside

Why This Matters

The latest Ronin network hack highlights the persistent risk of vulnerabilities in the network. Moreover, the involvement of white hat hackers increases the chances of the protocol recovering the majority of the funds.

Read more about the gray area in exploits in Rho Protocol: Was $7.6M Rho Protocol Exploit a Hack? Suspected Attacker Denies Wanting to Steal from Users

Read more about Binance Labs latest investments: Binance Labs Backs New Web3 Startups Despite Market Downturn