Axie Infinity co-founder loses $9.7M in 3,248-ETH wallet hack

Two crypto wallet addresses belonging to Jeff “Jihoz” Zirlin, one of the five co-founders of Axie Infinity and Ronin Network, were hacked, and roughly $9.7 million worth of Ether (ETH $2,937) was stolen and siphoned across Tornado Cash. 

On Feb. 23, blockchain investigator PeckShield alerted about a “whale wallet” compromise over the Ronin Bridge, reporting that the hacker made away with 3,248 ETH. Aleksander Larsen, co-founder of Ronin Network, immediately responded that “the (Ronin) bridge itself has top security” and suspected a wallet hack instead.

Larsen also highlighted that the Ronin Bridge had been audited and is designed to pause if an unusually large withdrawal is detected. Soon after, Zirlin confirmed that two of his personal wallets had been hacked. He said the attack was not due to vulnerabilities within the Ronin chain or Sky Mavis operations, adding:

I want to assure everyone that we have strict security measures in place for all chain-related activities.

Speaking to Cointelegraph, PeckShield said that the root cause of the hack was a “wallet compromise,” which allowed the unauthorized outbound transfer of funds.

While no particular details were shared about the events that led to the hack, Zirlin’s message suggests that the private keys of the two wallets were leaked, which led to unauthorized access to his personal crypto wallets.

Funds stolen from Axie Infinity’s Jihoz were transferred to Tornado Cash. Source: PeckShield

PeckShield’s investigation of the compromised wallets from Ronin Bridge v2 suggests that the 3,248-ETH loot was initially split and moved to three different wallets. The funds eventually made their way into Tornado Cash, a service often used by hackers to anonymize the funds’ ownership and traceability.

On Feb. 1, Binance froze $4.2 million worth of stolen XRP (XRP $0.54), a part of the $112-million hack on Ripple co-founder Chris Larsen’s personal wallet from Jan. 31.

Unlike Axie Infinity’s Jihoz hacker, Larsen’s hacker didn’t use crypto mixer services or decentralized exchanges to hide their identity. As a result, Binance was able to track down some of the funds and block them from the hacker’s access.