Ronin Bridge 黑客攻击：1200 万美元被盗，大部分 ETH 归还，疑似 MEV 漏洞

以太坊和专注于游戏的 Ronin 侧链之间的桥梁在周二早些时候因另一项漏洞而被停止，导致大约 1200 万美元的资金缺失

The bridge connecting Ethereum to the gaming-focused Ronin sidechain was briefly halted early Tuesday following an exploit that resulted within the lack of roughly $12 million price of property—however a lot of the funds have already been returned.

连接以太坊和以游戏为主的 Ronin 侧链的桥梁在周二早些时候短暂停止，原因是一次漏洞导致价值约 1200 万美元的财产损失，但大部分资金已经退回。

The incident, described as a possible “MEV exploit,” was dropped at mild early Tuesday by moral hackers, Ronin co-founder Aleksander Larsen mentioned on Twitter. He reassured customers that the bridge, which secures over $850 million in property, stays secure.

Ronin 联合创始人亚历山大·拉森 (Aleksander Larsen) 在 Twitter 上表示，这一事件被描述为可能的“MEV 漏洞”，周二早些时候，道德黑客已将其删除。他向客户保证，这座拥有超过 8.5 亿美元财产的桥梁将保持安全。

Related articles

相关文章

The Ronin account famous that roughly 4,000 ETH and $2 million price of the dollar-pegged USDC stablecoin have been swiped, including as much as about $12 million price of stolen property. The injury was restricted by safeguards that cap the dimensions of any Ronin withdrawal in a single transaction.

Ronin 账户指出，大约 4,000 个 ETH 和价值 200 万美元的与美元挂钩的 USDC 稳定币被盗，其中包括价值约 1200 万美元的被盗财产。此次伤害受到保障措施的限制，这些保障措施限制了单笔交易中任何 Ronin 提款的规模。

Later Tuesday morning, the Ronin team announced that the entire ETH—roughly $10 million price—had been returned, and that they anticipated the USDC to be returned later within the day. Ronin’s builders will reward the white hat hackers with a $500,000 reward for reporting the exploit and returning the swiped funds.

周二上午晚些时候，Ronin 团队宣布全部 ETH（价值约 1000 万美元）已被归还，他们预计 USDC 将在当天晚些时候归还。 Ronin 的开发者将奖励 50 万美元的白帽黑客，奖励他们报告漏洞并返还被盗资金。

Ronin’s group blamed an issue with a bridge improve launched earlier within the day, which it mentioned “launched a difficulty main the bridge to misread the required bridge operators vote threshold to withdraw funds.”

Ronin 的团队将其归咎于当天早些时候启动的桥梁改进的问题，并表示“在桥梁上启动了一个问题，误读了提取资金所需的桥梁运营商投票门槛。”

Adrian Hetman, head of triaging at blockchain safety agency Immunefi, advised Decrypt that bridge upgrades are widespread avenues for assaults as they’ll introduce new methods to take advantage of the connection between chains and steal funds.

区块链安全机构 Immunefi 的分类负责人 Adrian Hetman 告诉 Decrypt，桥升级是攻击的普遍途径，因为它们将引入新方法来利用链之间的连接并窃取资金。

“An improve introduces a brand new assault floor and, if carried out with out the mandatory safety measures, may doubtlessly result in the entire collapse of the mission,” Hetman mentioned, pointing to 2022’s attack of the Nomad protocol as a key instance.

海特曼表示：“改进引入了新的攻击层，如果没有强制安全措施，可能会导致任务彻底崩溃。”他指出，2022 年对 Nomad 协议的攻击就是一个关键例子。

Within the follow-up tweet, Ronin’s builders mentioned that the bridge code shall be audited earlier than it is introduced again on-line, and that they intend to work with community validators to “shift operation of the bridge away from the present construction.”

在后续推文中，Ronin 的建设者提到，桥梁代码应在再次在线引入之前进行审核，并且他们打算与社区验证者合作，“将桥梁的运营从当前的建设中转移出去”。

Ronin is the gaming-focused community that was initially launched for Axie Infinity, the monster-battling recreation that racked up billions of {dollars}’ price of NFT buying and selling quantity in 2021. Since then, it has expanded to function video games from different studios moreover Sky Mavis, together with the popular social farming game Pixels.

Ronin 是一个以游戏为中心的社区，最初是为《Axie Infinity》推出的，这款怪物战斗游戏在 2021 年的 NFT 交易量达到了数十亿美元。此后，它已扩展到包括从其他工作室还有 Sky Mavis，以及流行的社交农业游戏 Pixels。

At present, Ronin’s native token, RON, seems solely modestly affected by the information. Whereas the worth did broadly decline within the hours following the assault, RON rebounded barely and stays up more than 2% over the previous day amid a broader market rebound after Monday’s plunge. The token is priced at $1.43 as of press time, down 27% during the last week.

目前，Ronin 的原生代币 RON 似乎仅受到该信息的轻微影响。尽管价格在袭击发生后的几个小时内大幅下跌，但在周一暴跌后大盘反弹的情况下，RON 几乎没有反弹，比前一天上涨了 2% 以上。截至发稿时，该代币价格为 1.43 美元，上周下跌 27%。

This isn’t the primary time that the Ronin bridge has been compromised. In late March 2022, a significant hack resulted within the loss of $622 million from the community in an assault that the U.S. Treasury pinned on North Korea’s notorious Lazarus hacking group. The bridge was down for months, however was in the end revived with added decentralization measures as Sky Mavis refunded affected customers.

这并不是 Ronin 桥第一次遭到破坏。 2022 年 3 月下旬，一次重大黑客攻击导致社区损失 6.22 亿美元，美国财政部将其归咎于朝鲜臭名昭著的 Lazarus 黑客组织。这座桥已经瘫痪了几个月，但最终通过采取额外的去中心化措施恢复了运营，Sky Mavis 向受影响的客户退款。

A more recent February incident, although smaller, noticed $9.5 million price of ETH taken from Ronin wallets, together with these of Sky Mavis and Ronin Community co-founder Jeff Zirlin.

最近的 2 月份事件虽然规模较小，但注意到 Ronin 钱包中价值 950 万美元的 ETH 被盗，其中包括 Sky Mavis 和 Ronin Community 联合创始人 Jeff Zirlin 的钱包。

Ronin representatives declined additional remark to Decrypt following the tweeted assertion. A full postmortem report on the assault is predicted to be launched subsequent week.

在发布推文后，Ronin 代表拒绝对 Decrypt 发表更多评论。有关袭击事件的完整尸检报告预计将于下周发布。

By MEV, Larsen was referring to maximum extractable value bots, that are software program instruments developed to watch blockchains to search out revenue alternatives and robotically exploit them via automated transactions. The controversy round MEV bots facilities on equity and community integrity.

Larsen 所说的 MEV 指的是最大可提取价值机器人，它们是开发用于监视区块链以寻找收入替代方案并通过自动交易自动利用它们的软件工具。围绕 MEV 机器人设施有关公平和社区诚信的争议。

Critics have argued these bots exploit customers, enhance charges, and centralize energy to tech-savvy operators by facilitating front running, sandwich attacks, and back running, amongst different options. Supporters declare that they supply crucial market effectivity. The talk highlights tensions between profit-seeking habits and blockchain beliefs of equal entry.

批评者认为，这些机器人通过促进抢先运行、三明治攻击和反向运行等多种方式，剥削客户、提高收费，并将精力集中给精通技术的操作员。支持者声称它们提供了至关重要的市场效率。演讲强调了逐利习惯与平等进入的区块链信念之间的紧张关系。

This incident comes amid rising considerations over the safety of blockchain bridges. Immunefi recently reported that over $1.19 billion has been misplaced attributable to hacks and fraud within the yr to this point, marking a 16.3% enhance in comparison with the identical interval final yr. Bridges stay a key avenue for assaults.

这一事件发生之际，人们对区块链桥的安全性的担忧日益增加。 Immunefi 最近报告称，今年以来，由于黑客和欺诈造成的损失超过 11.9 亿美元，与去年同期相比增加了 16.3%。桥梁仍然是袭击的主要途径。

“The bridge accommodates a number of cash and is shifting giant quantities of funds each day,” Immunefi’s Hetman advised Decrypt. “This can be a juicy piece of code for any black hat looking for a means in and steal a portion of it or all of it, the identical as for the white hats attempting to guard the customers and the mission.

“这座桥可容纳大量现金，每天都会转移大量资金，”Immunefi 的 Hetman 向 Decrypt 表示。 “对于任何想要窃取部分或全部内容的黑帽子来说，这可能是一段有趣的代码，就像试图保护客户和任务的白帽子一样。