Sounds like if they had a checking account with their bank credentials stored in ENV variables and someone got access to that server it would be the same outcome.

The details of it being on a crypto-currency are interesting but when password/passphrase/private key security is poor it doesn't really matter the medium holding the money.

Yes, it is truly mystifying how they operate in some of these big projects.

Recently, we had Optimistic Ethereum (by my count, ~$250 million locked up in that network) adamantly insisting that they did everything they could to warn users that transaction history would get deleted off of Etherscan.io -- trivially avoidably, no less! -- even though none of their communication channels mention it.[1]

And that they had to make a "tradeoff" in how much effort to spend on warning users, even though their volunteers are choked every day, on Discord, with users wondering where their transaction history is.

Which, of course, pales in comparison to how a hacker found a flaw that let him print infinite ETH within their network (see the main story for that thread), and the project only lives on because he was a white hat who accepted a bounty instead.

[1] https://news.ycombinator.com/item?id=30293526

> they just compromised 4 systems holding the private keys, and there was an RPC signing function giving free access to the 5th.

This seems like the plot of a 90's hacker movie.

Wait, no, it's totally believable because this is the same story that happens over and over again with blockchains. It turns out that all of those pain in the ass compliance laws on traditional finance are there for a reason, and when you ignore the past you end up repeating it.

Or malicious...similar to the DAO hack from 2017 suspected of being an inside job (with evidence pointing to the insider who lawyered up to refute it with code-is-law argument), somebody was accountable for security and they deemed it not worth it to secure it.

Axie Infinity was already struggling, and this happens a day or two away from scheduled distribution of rewards & update release.

Cui bono? Who could've known they were carrying funds in a hot wallet other than the people directly involved with the project? Unless there was a way to discover this from the outside?

Somebody at Axie Infinity could have been asking whether they want to get paid 0.025% of that hot wallet yearly or have it all up front, today. After all it isn't cash sitting at a bank they have to rob.

It isn't like monitoring would have done anything. Once the transaction goes out it is gone. The core problem here is the massive private-key bounty being created by a ton of organizations that don't have world-class security teams.

Many crypto companies are subject to RIA compliance laws or are considered "qualified custodians"