Chainalysis Aids in Recovering $30M From Axie Infinity, Ronin Hack

Over $30 million stolen during an attack on the Ronin Network this year has been recovered with the help of Chainalysis.

$30 Million in Crypto Seized

Chainalysis has helped law enforcement recover $30 million of stolen crypto.

Chainalysis’ senior director of investigations Erin Plante appeared at Axie Infinity’s AxieCon to discuss the investigation.

Plante noted that Chainalysis, with the aid of other organizations, helped law enforcement to seize $30 million of the $600 million previously stolen from Ronin Network.

Some of those funds were stolen from Axie Infinity, a popular decentralized game built on Ronin Network. The $30 million of recovered funds represents 10% of the amount stolen from Axie Infinity, accounting for price differences over time.

The attack was carried out by Lazarus Group, an infamous state-backed hacking group based in North Korea. Plante noted that the recovery marks “the first time ever that cryptocurrency stolen by a North Korean hacking group has been seized.”

Chainalysis also detailed the process of the Ronin attack. It explained that Lazarus Group gained access to the private keys of Ronin Network validators, then withdrew and laundered funds. Tornado Cash, recently sanctioned by the U.S. Treasury, was one tool the group used to swap tokens and launder funds.

Chainalysis stressed that its ability to trace these transactions relied on blockchain transparency as well as cooperation between the public and private sectors. It said that its investigation would “never be possible in traditional financial channels.”

Ronin Network was initially attacked in March of this year. Lazarus Group was implicated in the attack in April.

Other attempts to recover funds also occurred at that time. Leading crypto exchange Binance recovered $5.8 million from the attack in April. Meanwhile, Axie Infinity developer Sky Mavis dedicated a $150 million fundraiser to user compensation.

Ronin Network reopened in June, assuring users that its newly designed platform had undergone full security audits.

Disclosure: At the time of writing, the author of this piece owned BTC, ETH, and other cryptocurrencies.