The FBI has tied the recent Axie Infinity Ronin sidechain hack to North Korea | Hacker News Reader

The FBI has tied the recent Axie Infinity Ronin sidechain hack to North Korea

thismorningonchain.com

90 pointsnscalf52 comments

It seems that crypto and blockchain-based systems may well hurt the standing of the US if they allow US adversaries to evade financial sanctions.

I wonder if US lawmakers would step in to try to shut down these systems. It may be politically very difficult since there is so much money riding on crypto now, and many US lawmakers reflexively support crypto in order to appear pro innovation.

If a state like North Korea, that brutally represses its population, is able to use a censorship resistant technology to escape US sanctions, the US should not respond by instituting highly repressive laws to contain that censorship resistant technology. This is totally counter-productive to the larger policy objective, of advancing the values of liberal democracy, like individual liberty, privacy and respect for human rights, that motivates opposition to the North Korean state.

If sanctions cannot be effectively enforced without repressing decentralized platforms, then the US should look to other tools of statecraft to combat problematic states like North Korea.

Are you saying that the censor-resistant purity of crypto has the ability to inspire values of liberal democracy in the lackies who toil in NK's hacking farms?

That seems rather idealistic, let alone any likelihood of it leading to democratic values taking root there.

No. I have no idea if North Korean society has the necessary conditions, like globally integrated internet communities of appreciable size, where cryptocurrency can effect change.

I'm saying that censorship resistant finance reduces the impact of repressive laws around the world. It helps individuals circumvent laws like those instituted in places like Venezuela and China, that give the state enormous power over private citizens by controlling how they move money.

Stopping North Korea from using cryptocurrency would require very repressive laws to shut down entire global cryptocurrency networks, which in and of itself would make for a less free world because of the extremely heavy-handed enforcement actions that such a campaign would require. On top of this, the end result of such a campaign were it to succeed - of these censorship resistant networks not existing - would further undermine the goal of creating more free societies, for reasons mentioned above.

How does funding organized crime help worldwide freedom?

Financially disempowered people are much more susceptible to organized crime, like the kind that control human trafficking and smuggling networks.

> then the US should look to other tools of statecraft to combat problematic states like North Korea.

What do you suggest? North Korea is effectively a rogue state, only having relations with China and sort of Iran. What other statecraft tools do you think the US has its disposal?

Massively increase counter-espionage budgets, to shadow NK agents outside of the country, and counter their malign activity. It may be costly, but the cost of creating a global surveillance state, with AML checks encumbering billions of interactions each day, is bound to be greater. This is just a small fraction of the costs involved:

https://risk.lexisnexis.com/insights-resources/research/2019...

The impact on the developing world is profound:

https://finance.yahoo.com/news/money-reimagined-starve-ugly-...

I'm not sure if the issue is that north korea has particularly good intelligence. It's more so that they have nuclear weapons and aren't afraid to tell us how they'd use them. Maybe leaders who are able to leave would be annoyed, but I'm pretty sure they are already being annoyed, and I'm no sure if that's enough to convince them to change their behavior.

By agents, I was also including economic agents, that raise hard currency for the government outside of the country. A discriminating approach would aid NK refugees, while blocking the actions of agents of the NKean state. That could blunt some of the humanitarian damage from blocking inflows of hard currency from the latter into the country, since the former still maintain ties to family in the country, and could be a source of aid to them.

Other ways to counter the threat posed by the North Korean state include aiding and encouraging South Korea and Japan in building up their armed forces, as a deterrent to any North Korean attack, and expanding deployments of missile defense systems while increasing funding for the development of more advanced missile defense systems.

Yet another approach could be to apply pressure on North Korea's allies, like Iran and China, to reduce military cooperation with the state, as long as it remains outside of the Non-Proliferation Treaty.

The power of the USD and related sanctions isn't whether North Korea can move trivial sums of money in the process of modest criminal activities (trivial and modest in the scale of national economies of consequence), it's whether you can heavily limit their ability to freely trade with the global economy. Bitcoin and Ethereum are not going to help North Korea very much in the scope of what they'd require. The US will (sooner or later) notice if X country in Asia suddenly starts doing $20 billion per year in crypto-based trade with North Korea, and that X country can be damaged economically as necessary to dissuade (make it not worth doing).

That ability continues until you can convince most nations to abandon their currencies and turn all of that economic self-determination and political power over to independent crypto systems they have no control over. It ain't gonna happen.

> I wonder if US lawmakers would step in to try to shut down these systems.

It's unecessary to shut down because fiat off-ramps are the Achilles heal. Already there are wallet address banlist [1]; and woe to any instituion who processes transactions which originate from those addresses.

[1] https://home.treasury.gov/policy-issues/financial-sanctions/...

How do those banlists work? If they send a bunch of coins to innocent wallets, are those now completely tainted or are people tracking what percentage of coins in each wallet are "legitimate"?

I always figured the best way to take your filthy crypto lucre to an fiat is through NFTs. Mint something stupid and sell it to your banned wallet for a ridiculous price. If you just send it from one wallet to another there is no plausible deniability and that transaction will be tracked and scrutinized. Just like laundering fiat through fine art you have to have something that can be subjectively valued and sold.

Have financial sanctions worked in anything other than making the people of the country remain poor?

Making your adversary poor is the whole point of sanctions, so no. But that is the end in itself. Poor countries have a much harder time waging offensive wars.

It also supplies a opposing fact to some forms of internal propaganda, especially when tied to a discrete event in the country's foreign policy.

The counter argument to that justification of sanctions is that financial interdependence also discourages war. I mean, if North Korea gets nukes they can still shoot them and cause a lot of trouble, and we pretty much have no additional leverage aside from direct military intervention or taking the people one step further from poor -> dead.

With Russia sanctions are doing some damage right now, even if it hasn’t stopped the war. With North Korea we’ve blown our load and the main casualty is just a destitute population over there.

> With North Korea we’ve blown our load

Actually no, much more could be done against North Korea. A total naval blockade, for example.

> Actually no, much more could be done against North Korea. A total naval blockade, for example.

Isn't virtually all their trade land trade via China? Short of a land invasion to cut off that border, I don't see how any kind of a blockade makes much of a difference.

There’s a decent amount of maritime trade, especially for oil. Fishing is also important for the domestic economy.

That’s going from passive to active though. If active it can be considered basically like invasion/physical war.

I’m not convinced that actually matters wrt North Korea.

Besides, sanctions enforcement turns pretty active when you start prosecuting violators.

> The counter argument to that justification of sanctions is that financial interdependence also discourages war

It discourages war because of the threat of being cut off.

If you don't actually carry the threat out, it stops being an effective threat.

I'm skeptical that crypto tokens are capable of allowing NK to effectively evade sanctions. The reality is that cryptocurrencies are terrible currencies and doing business with a sanctioned country is far less risky using fiat cash than than using any type of blockchain.

They hurt everyone.theyre scams.

Don't turn a scam into some political commentary

> The Axie DAO allowlisted Sky Mavis to sign various transactions on its behalf. This was discontinued in December 2021, but the allowlist access was not revoked. Once the attacker got access to Sky Mavis systems they were able to get the signature

So a question remains of how the attacker got access to Sky Mavis systems?

> A security audit likely would have identified an inherent problem in the majority of the multisig keys being stored on a single server.

There was no security aduit? Can anyone more familiar with this project add context?

The context here is that Axie was using a "proof of authority" blockchain, which is controlled by a predetermined set of signers. This is already very bad because it makes them a custodian of the money on the chain. Worse, they used it in a very insecure way where they held a majority of the keys on one server.

So, not only did they call an effectively centralized server a "blockchain", they also acted deceptively about the number of centralized custodians on that multisig, by pretending there were 9 entities when there was only one.

Most likely, the underlying code was audited as being secure when used by a larger group of independent validators. If there were 20, it would be very hard to compromise them all. The code that was broken was probably some other dumb utility on the server that got hit by a regular privilege escalation vulnerability or something.

Spot on. They said they're increasing the number of validators, but ultimately the biggest issue with how they implemented this was that they put so many multisig keys in the same spot. They could have 100,000 validators, if 50,001 multisig keys are on their server, and they need a simple majority, it's just as vulnerable.

They did say that they are expanding the amount of individual entities holding multisig keys, so they seem to realize this was a bad idea.

I would say this is one of the primary use cases for a decentralized currency, from the perspective of avoiding sanctions as an economically isolated country. I've also seen an argument from Ukrainian activists who are using crypto when Russia froze their bank accounts.

Which is even more amusing because the Ukrainian activists using crypto to bypass a Russian freeze may very well be trading on-chain with Russian oligarchs evading sanctions.

They (Kim's gang) are never going to be able to really take advantage of the funds as the associated addresses have been fully blacklisted around the world and they are never going to be able to find enough liquidity on alternative mediums in order to fully cash in. What a waste. This only helps deflate the crypto a bit more which I guess is good for the hodlers.

Defi and dex mixers to privacy coins or projects like secret is or will be doable.

Seems like a lot of crypto stories end with, "And none of the investors ever saw their money again".

Sky Mavis raised $150M, and is going to be funding the remaining ~$470M to make investors whole. This doesn't look like it's one of those stories.

wait, they raised another 150 million after they just lost 600 million? And they just have 470 million lying around? I honestly give up, I don't understand anything any more

Yeah I want to do business with those investors putting in the $150 million, since they appear to be in the business of giving away free money.

They're not unknown investors, Binance and a16z are in the round.

Ok nice. So NK uses the internet, www, email, computers, mathematics...

Currency created to get around regulations used to get around regulations. News at 11.

The story here is actually that NK is now targeting crypto exchanges in their panoply of hacking targets.

That can't be new though? Gotta be the most obvious target on any list.

Anyone notice GPUs magically started to appear for sale right around the time Russian sanctions went into effect? I wonder why…

Reply on news.ycombinator.com