Fake Job Offer Reportedly Led to Axie Infinity’s $600M Hack

The Block published a story on Wednesday that revealed how a socially engineered fraudulent job offer caused the $620 million Axie Infinity hack.

The report claims that hackers posing as job recruiters on LinkedIn approached staff at Sky Mavis, the developer of Axie Infinity, according to two sources with direct knowledge of the situation. At least one employee, a senior engineer, took the bait and went to many interviews.

The “interviews” went off without a hitch, and the engineer received a PDF file offering a position. Unfortunately, they downloaded the harmful file and allowed hackers to access Ronin, the Ethereum-based sidechain that underpins Axie Infinity. After that, attackers were able to penetrate and hijack four out of nine Ronin validators — leaving them just one validator short of total domination.

Hackers took control of a fifth node in the supposedly decentralized network Axie DAO after Sky Mavis was given the ability to sign transactions during a peak period in November. They then removed the Ethereum and USDC cryptocurrency that backed the Sky Mavis treasury valued at around $625 million.

In the previous post-mortem, Sky Mavis pointed to “advanced spear-phishing attempts” that exploited a former employee who no longer worked for the company – but did not go into detail about how the hack was carried out.

Recently, Sky Mavis has finally reopened Ronin Bridge after closing it for many months in the wake of one of the biggest crypto scams of the year. He raised $150 million in capital to assist payback players, and last week he reopened transactions on his Ronin bridge. It also implemented more security precautions to prevent future attacks.

Meanwhile, a second game called Axie Infinity Origins tried to distance itself from being labeled a money-making project rather than a game that is simply enjoyed.