The stolen ethers were routed through a network bridge to three separate Ethereum wallets and then transferred to the Tornado Cash cryptocurrency mixer. This automated service is used to mix products to “cover your tracks”. Jeff Zirlin elaborated on the details of the attack:
“It was a tough morning for me.. Two of my addresses have been compromised. The attack was limited to my personal accounts and did not affect Ronin's validation or operation.. The key leak has nothing to do with the operations of Sky Mavis, the developer of the NFT game Axie Infinity. I want to assure everyone that we have strict security measures in place for all network-related activities,” Zirlin wrote.
Sky Mavis co-founder Aleksander Larsen confirmed Zirlin's comments that the attack did not affect the security of the Ronin Network and Sky Mavis facilities. According to Larsen, the network bridge has a high level of security: it has passed many checks and suspends work if too many funds are withdrawn. The RON rate briefly fell more than 13% from $3.17 to $2.74 as funds were eventually withdrawn from the network.. Later, the rate of the crypto asset recovered to $3.
The attack on Zirlin's wallets comes two years after attackers hacked the Ronin Bridge and then transferred $625 million worth of USDC and ETH stablecoins to the Tornado Cash mixer. The North Korean hacker group Lazarus is suspected of carrying out this attack. In April 2022, the largest exchange Binance helped return $5.8 million worth of stolen crypto assets.