US Treasury links North Korea hackers to Axie Infinity $625 million heist

An update from the Ronin network, the ethereum-linked sidechain created by Sky Mavis for Axie Infinity, cites the United States Department of Treasury and the Federal Bureau of Investigation (FBI) attributing the recent USD 625PHP 36,678INR 52,969EUR 595CNY 4,549 million theft (in ethereum and USDC) from Axie Infinity users to the hacking group known as the Lazarus Group. The digital currency address linked to Lazarus has been reportedly involved in the Ronin Bridge hack. The said address currently holds over USD 445PHP 26,115INR 37,714EUR 424CNY 3,239 million worth in ethereum.

Also known in other names such as Appleworm, Guardians of Peace, Hidden Cobra, Red Dot, and Whois Hacking Team, the Lazarus Group is believed to have been established in 2009-2010, allegedly derived from North Korea’s Reconnaissance General Bureau (Jeongchal Chongguk) and Korea Computer Center (Joseon Kompyuteo Ssenteo). The Lazarus Group is included in the US Department of Treasury’s sanctions list.

At the moment, it has also been announced that additional security features are being installed to prevent future attacks prior to redeploying the Ronin Bridge later this month. Earlier, Sky Mavis launched a USD 150PHP 8,803INR 12,712EUR 143CNY 1,092 million fundraiser with Binance, Animoca Brands, a16z, Dialectic, and Paradigm to ensure reimbursement for users affected by the hack. It also projects to increase its validator group to 21 members in the next three months.

“Sky Mavis is committed to reimbursing all of our users’ lost funds and implementing rigorous internal security measures to prevent future attacks,” said Sky Mavis CEO Trung Nguyen in a statement.

The aftermath of what is regarded as one of the largest hacks in cryptocurrency history, however, would only be one of Axie Infinity’s issues moving forward. Since at least February, the play to earn game has been losing players, from 2.3 million daily active users to 2.2 million daily active users in March according to ActivePlayer.io.

This is the first time since at least 2020 that the number of players decreased, showing signs that NFT-based games such as Axie Infinity might not be immune to traditional gaming scenarios. Bloomberg reports an even lower statistic: 1.45 million daily active users before the hack occurred. The Verge, meanwhile, observes that Sky Mavis has yet to optimize its in-game economy, which has been mostly growth-driven and heavily dependent on the influx of new entrants. The solution for the medium-term, it seems, would be the launch of their free-to-play title Axie Infinity: Origin. Some experts, however, see that the hack can be an accelerator of eroding trust in the said game.

“It became a victim of its own success,” said Jon Jordan, a blockchain gaming consultant and an early Axie Infinity adopter, “There was an economy that probably wasn’t balanced, but wasn’t horribly overbalanced in one direction — then that became horribly unbalanced.”