In Brief:
- Axie Infinity and Ronin co-founder Jeff “Jihoz” Zirlin said Sunday that the February 2024 theft from his personal wallets was “due to a home invasion.” He said he has sent the FBI all the details, including the identity of a suspected perpetrator.
- Zirlin said he’s in touch with Chainalysis about “recovery efforts for frozen funds” and rejected claims that he hacked himself.
- The 2024 attack drained two of his addresses of about $9.7 million. The proceeds were converted to ETH and pushed through Tornado Cash.
Jeff “Jihoz” Zirlin said the 2024 hack of his personal wallets came out of a home invasion. It’s the first time he has publicly given a cause for the theft of roughly $9.7 million.
“The hack was due to a home invasion and i’ve sent all details including the suspected perpetrator to the FBI,” Zirlin said in a post on X on Sunday.
My hacked address interacted with tornado cash.
If it was me hacking myself i would be in jail or under investigation.
The hack was due to a home invasion and i’ve sent all details including the suspected perpetrator to the FBI.
I’m also in touch with chainalysis regarding
He said he’s also working with blockchain analytics firm Chainalysis. “I’m also in touch with chainalysis regarding the recovery efforts for frozen funds,” Zirlin said. He didn’t say how much was frozen or where.
A response to “lies”
Zirlin aimed the post at critics who had suggested he was behind the theft. He named two of them.
“Nico/Tengri please stop these lies. I hope your health is doing better than when we last met,” Zirlin said.
He opened by pointing to the laundering trail. “My hacked address interacted with tornado cash,” Zirlin said. “If it was me hacking myself i would be in jail or under investigation.”
He also addressed recent activity tied to the compromised wallet. “My addresses are all transparent and i don’t need to use my hacked address to deal with small amounts of RON,” Zirlin said.
The post didn’t say when the home invasion took place or who the suspect is. It also didn’t say whether the FBI has opened a case.
What was taken
The theft became public on Feb. 23, 2024, when security firm PeckShield flagged a large outflow through the Ronin Bridge. PeckShield called the root cause a “wallet compromise” that allowed unauthorized transfers out of two of Zirlin’s addresses.
PeckShield said the attacker split 3,248 ETH across three wallets before moving it into Tornado Cash.
On-chain analytics account Lookonchain put the total haul at $10.46 million. That included 3.2 million RON worth $9.53 million, 282.32 WETH worth $834,000, 160,000 PIXEL worth $87,000, 2.76 million SLP worth $10,000, 2,042 USDC and 164 AXS worth $1,272. Lookonchain said everything was converted to 3,249 ETH, worth about $9.6 million, and deposited into Tornado Cash.
The attacker’s sale of more than 3 million RON pushed the token down about 9%. AXS held steady.
Zirlin’s account at the time
At the time, Zirlin said the breach was limited to him personally.
“The attack is limited to my personal accounts, and has nothing to do with validation or operations of the Ronin chain,” Zirlin said then. He added that the leaked keys had nothing to do with Sky Mavis operations.
“Thank you to everyone that’s reached out. I’m safe,” he said.
Fellow Ronin co-founder Aleksander Larsen said the bridge and the chain had no problems and called the incident a whale wallet theft. Zirlin gave no further detail in 2024 on how his keys were exposed. Sunday’s post is the first time he has offered an explanation.
The Ronin shadow
The wallet drain came nearly two years after the March 2022 Ronin Bridge exploit, which took about $625 million. U.S. officials attributed that attack to North Korea’s Lazarus Group and said it also used Tornado Cash to launder the proceeds. Chainalysis later helped authorities seize $30 million in crypto tied to the 2022 hack.
After the 2022 breach, a CNN reporter asked Zirlin whether it could have been an inside job. He answered with one word: “No.”
