After Hack, Ronin Offers $1M Bug Bounty, Plans to Double Number of Nodes

After a $600 million hack last month, Ronin Network and Sky Mavis have vowed to upgrade their smart contracts, offer generous bug bounties, and tighten security measures.

As previously reported by Cointelegraph, the Ethereum sidechain developed for the popular NFT game axy Infinity was attacked when 173,600 Ethereum (ETH) and $25.5 million USDC worth more than $612 million were stolen.

Earlier this month, the FBI blamed the attack on North Korea-based state-backed hacking group Lazurus and issued a warning to other cryptocurrency and blockchain groups.

In a post-mortem published yesterday, Ronin announced the changes to its platform, noting that all users’ funds are in the process of being restored and promising to ensure that this “doesn’t happen again.”

hacker failed

The hack was the result of a spear-phishing attack targeting former Sky Mavis employees, developers of Axie Infinity. Malicious actors were able to leverage the employee's credentials to access four of Sky Mavis' total nine validator nodes in the Axie/Ronin ecosystem.

This alone wasn't enough to do any damage, but "the attackers discovered a backdoor through our gas-free RPC node, which they abused to obtain signatures from Axie DAO validators."

"This dates back to November 2021, when Sky Mavis requested Axie DAO to help distribute free transactions due to heavy user load. Axie DAO allowed Sky Mavis to sign various transactions on its behalf. This was stopped in December 2021, but not revoked Allow list access," the report reads.

Both Sky Mavis and Ronin Network are making major changes following the hack.

Ronin

Ronin Network hopes to open its bridge again by mid-to-late May, at which point Binance will support withdrawal and deposit infrastructure for Axie users.

About 80% of the team upgraded the Ronin bridge smart contract, they will redesign the backend, migrate all pending withdrawals and launch a validator dashboard that "allows approval of large transactions and addition/removal of new validators".

“The Ronin Network bridge is currently being redesigned and will open once we are confident it will stand the test of time. We initially expected to be able to deploy the upgrade by the end of April, but this is not a process we can rush through.”

Sky Mavis

Sky Mavis will beef up its security measures by enlisting the help of "top security experts", conducting contract audits and implementing stricter internal procedures such as training sessions to "combat external threats".

Notably, it will also significantly increase its node count to help decentralize the project. Sky Mavis has grown from nine to 11 and intends to increase that number to 21 within three months. In the long run, the project is eyeing 100+ nodes.

Sky Mavis is also offering a bug bounty of up to $1 million to any white hat hacker who can find more bugs.

"We recognize the importance and value of the efforts of security researchers in helping to keep our community safe. Sky Mavis is offering bounties of up to $1 million to encourage responsible disclosure of security vulnerabilities."