Norwegian Authorities Recoup $5.9M From Axie Infinity Ronin Hack

Norwegian authorities have seized 60 million krone (nearly $5.9 million) in stolen cryptocurrency, according to a statement released today, as part of an investigation into last year’s attack on Sky Mavis and its game Axie Infinity.

It is the largest crypto seizure ever made by Norwegian police, the statement notes, and is among the largest ever cash seizures made in Norway.

"We are working with FBI specialists on cryptocurrency tracking. This kind of cooperation between countries makes us stronger as a society in the fight against digital, profit-motivated crime," First State Attorney Marianne Bender said, per a translation of the original announcement.

The Ronin investigation, one year on

It’s been nearly a year since hackers allegedly linked to North Korea were able to drain $622 million worth of crypto at the time from Axie Infinity’s Ronin bridge. At least 10% of those funds have already been recovered by investigators with assistance from blockchain analytics firm Chainalysis.

The theft on March 23, 2022, involved a sophisticated hack of the bridge between Axie Infinity’s Ronin sidechain and the Ethereum mainnet. To access the funds held in the bridge’s wallet, the hacker needed the private keys for at least five of the nine validator nodes.

Shortly after the exploit, U.S. officials linked North Korean hacking group Lazarus with the Ethereum wallets used to carry out the hack.

The attacker didn’t hold the funds in those wallets very long, however. Just $376.73 was left by April 4 as the hacker tried to obfuscate the origin of the coins by routing through intermediaries such as the now-shuttered privacy protocol Tornado Cash.

Nevertheless, investigators have shown their ability to track funds on-chain using advanced tracing tools.

“Økokrim is good at following money,” Bender said per translation in today’s announcement. “This case shows that we also have a great capacity to follow the money on the blockchain, even if the criminals use advanced methods.”