Ronin Bridge 駭客攻擊：1,200 萬美元被盜，大部分 ETH 歸還，疑似 MEV 漏洞

以太坊和專注於遊戲的 Ronin 側鏈之間的橋樑在周二早些時候因另一個漏洞而被停止，導致大約 1200 萬美元的資金缺失

The bridge connecting Ethereum to the gaming-focused Ronin sidechain was briefly halted early Tuesday following an exploit that resulted within the lack of roughly $12 million price of property—however a lot of the funds have already been returned.

連接以太坊和以遊戲為主的 Ronin 側鏈的橋樑在周二早些時候短暫停止，因為漏洞導致價值約 1200 萬美元的財產損失，但大部分資金已經退回。

The incident, described as a possible “MEV exploit,” was dropped at mild early Tuesday by moral hackers, Ronin co-founder Aleksander Larsen mentioned on Twitter. He reassured customers that the bridge, which secures over $850 million in property, stays secure.

Ronin 聯合創始人亞歷山大·拉森 (Aleksander Larsen) 在 Twitter 上表示，這一事件被描述為可能的“MEV 漏洞”，週二早些時候，道德駭客已將其刪除。他向客戶保證，這座擁有超過 8.5 億美元財產的橋樑將保持安全。

Related articles

相關文章

The Ronin account famous that roughly 4,000 ETH and $2 million price of the dollar-pegged USDC stablecoin have been swiped, including as much as about $12 million price of stolen property. The injury was restricted by safeguards that cap the dimensions of any Ronin withdrawal in a single transaction.

Ronin 帳戶指出，大約 4,000 個 ETH 和價值 200 萬美元的與美元掛鉤的 USDC 穩定幣被盜，其中包括價值約 1200 萬美元的被盜財產。這次傷害受到保障措施的限制，這些保障措施限制了單筆交易中任何 Ronin 提款的規模。

Later Tuesday morning, the Ronin team announced that the entire ETH—roughly $10 million price—had been returned, and that they anticipated the USDC to be returned later within the day. Ronin’s builders will reward the white hat hackers with a $500,000 reward for reporting the exploit and returning the swiped funds.

週二上午晚些時候，Ronin 團隊宣布全部 ETH（價值約 1000 萬美元）已歸還，他們預計 USDC 將在當天晚些時候歸還。 Ronin 的開發者將獎勵 50 萬美元的白帽駭客，獎勵他們報告漏洞並返還被盜資金。

Ronin’s group blamed an issue with a bridge improve launched earlier within the day, which it mentioned “launched a difficulty main the bridge to misread the required bridge operators vote threshold to withdraw funds.”

Ronin 的團隊將其歸咎於當天早些時候啟動的橋樑改進的問題，並表示“在橋樑上啟動了一個問題，誤讀了提取資金所需的橋樑運營商投票門檻。”

Adrian Hetman, head of triaging at blockchain safety agency Immunefi, advised Decrypt that bridge upgrades are widespread avenues for assaults as they’ll introduce new methods to take advantage of the connection between chains and steal funds.

區塊鏈安全機構 Immunefi 的分類負責人 Adrian Hetman 告訴 Decrypt，橋升級是攻擊的普遍途徑，因為它們將引入新方法來利用鏈之間的連接並竊取資金。

“An improve introduces a brand new assault floor and, if carried out with out the mandatory safety measures, may doubtlessly result in the entire collapse of the mission,” Hetman mentioned, pointing to 2022’s attack of the Nomad protocol as a key instance.

海特曼表示：「改進引入了新的攻擊層，如果沒有強制安全措施，可能會導致任務徹底崩潰。」他指出，2022 年對 Nomad 協定的攻擊就是一個關鍵例子。

Within the follow-up tweet, Ronin’s builders mentioned that the bridge code shall be audited earlier than it is introduced again on-line, and that they intend to work with community validators to “shift operation of the bridge away from the present construction.”

在後續推文中，Ronin 的建造者提到，橋樑代碼應在再次在線引入之前進行審核，並且他們打算與社區驗證者合作，「將橋樑的運營從當前的建設中轉移出去」。

Ronin is the gaming-focused community that was initially launched for Axie Infinity, the monster-battling recreation that racked up billions of {dollars}’ price of NFT buying and selling quantity in 2021. Since then, it has expanded to function video games from different studios moreover Sky Mavis, together with the popular social farming game Pixels.

Ronin 是一個以遊戲為中心的社區，最初是為《Axie Infinity》推出的，這款怪物戰鬥遊戲在 2021 年的 NFT 交易量達到了數十億美元。還有Sky Mavis，以及受歡迎的社交農業遊戲Pixels。

At present, Ronin’s native token, RON, seems solely modestly affected by the information. Whereas the worth did broadly decline within the hours following the assault, RON rebounded barely and stays up more than 2% over the previous day amid a broader market rebound after Monday’s plunge. The token is priced at $1.43 as of press time, down 27% during the last week.

目前，Ronin 的原生代幣 RON 似乎僅受到該資訊的輕微影響。儘管價格在襲擊發生後的幾個小時內大幅下跌，但在周一暴跌後大盤反彈的情況下，RON 幾乎沒有反彈，比前一天上漲了 2% 以上。截至發稿時，該代幣價格為 1.43 美元，上週下跌 27%。

This isn’t the primary time that the Ronin bridge has been compromised. In late March 2022, a significant hack resulted within the loss of $622 million from the community in an assault that the U.S. Treasury pinned on North Korea’s notorious Lazarus hacking group. The bridge was down for months, however was in the end revived with added decentralization measures as Sky Mavis refunded affected customers.

這並不是 Ronin 橋第一次遭到破壞。 2022 年 3 月下旬，一次重大駭客攻擊導致社區損失 6.22 億美元，美國財政部將其歸咎於北韓臭名昭著的 Lazarus 駭客組織。這座橋已經癱瘓了幾個月，但最終通過採取額外的去中心化措施恢復了運營，Sky Mavis 向受影響的客戶退款。

A more recent February incident, although smaller, noticed $9.5 million price of ETH taken from Ronin wallets, together with these of Sky Mavis and Ronin Community co-founder Jeff Zirlin.

最近的 2 月事件雖然規模較小，但注意到 Ronin 錢包中價值 950 萬美元的 ETH 被盜，其中包括 Sky Mavis 和 Ronin Community 聯合創始人 Jeff Zirlin 的錢包。

Ronin representatives declined additional remark to Decrypt following the tweeted assertion. A full postmortem report on the assault is predicted to be launched subsequent week.

在發布推文後，Ronin 代表拒絕對 Decrypt 發表更多評論。有關襲擊事件的完整屍檢報告預計將於下週發布。

By MEV, Larsen was referring to maximum extractable value bots, that are software program instruments developed to watch blockchains to search out revenue alternatives and robotically exploit them via automated transactions. The controversy round MEV bots facilities on equity and community integrity.

Larsen 所說的 MEV 指的是最大可提取價值機器人，它們是開發用於監視區塊鏈以尋找收入替代方案並透過自動交易自動利用它們的軟體工具。圍繞 MEV 機器人設施有關公平和社區誠信的爭議。

Critics have argued these bots exploit customers, enhance charges, and centralize energy to tech-savvy operators by facilitating front running, sandwich attacks, and back running, amongst different options. Supporters declare that they supply crucial market effectivity. The talk highlights tensions between profit-seeking habits and blockchain beliefs of equal entry.

批評者認為，這些機器人透過促進搶先運作、三明治攻擊和反向運作等多種方式，剝削客戶、提高收費，並將精力集中給精通科技的操作員。支持者聲稱它們提供了至關重要的市場效率。演講強調了逐利習慣與平等進入的區塊鏈信念之間的緊張關係。

This incident comes amid rising considerations over the safety of blockchain bridges. Immunefi recently reported that over $1.19 billion has been misplaced attributable to hacks and fraud within the yr to this point, marking a 16.3% enhance in comparison with the identical interval final yr. Bridges stay a key avenue for assaults.

這事件發生之際，人們對區塊鏈橋的安全性的擔憂日益增加。 Immunefi 最近報告稱，今年以來，由於駭客和詐欺造成的損失超過 11.9 億美元，與去年同期相比增加了 16.3%。橋樑仍然是襲擊的主要途徑。

“The bridge accommodates a number of cash and is shifting giant quantities of funds each day,” Immunefi’s Hetman advised Decrypt. “This can be a juicy piece of code for any black hat looking for a means in and steal a portion of it or all of it, the identical as for the white hats attempting to guard the customers and the mission.

「這座橋可容納大量現金，每天都會轉移大量資金，」Immunefi 的 Hetman 向 Decrypt 表示。 「對於任何想要竊取部分或全部內容的黑帽子來說，這可能是一段有趣的程式碼，就像試圖保護客戶和任務的白帽子一樣。