Sky Mavis offers up to $1m in bug bounty after losing $625m in major hack

Sky Mavis, the development studio behind popular NFT game Axie Infinity, is stepping up its efforts to secure its networks. The company is offering up to $1 million (around Rs 7.5 crore) as bug bounty to developers who could identify security flaws in its networks. The milestone follows a mega hacking incident that drained Sky Mavis’ Ronin network of $625 million (roughly Rs. 4,729 crore). The Ronin Network is an Ethereum-related sidechain built by Sky Mavis specifically for blockchain gaming.

In a detailed blog, Sky Mavis called for responsible disclosure of security vulnerabilities that could affect its operation and its users.

“During your research, we would like to ask you to refrain from automated testing, denial of service, spamming, spoofing and phishing. Carry out other attacks once you have proof of ‘Remote Control Execution (RCE) attacks may result in the loss of your bounties,’ reads the policy section of the bug bounty program.

Rewards will be paid out in the form of Axie Infinity’s native AXS token. According to CoinMarketCap, each AXS is currently priced at $48 (around Rs 3,673).

“Only vulnerabilities with a working proof of concept that shows how it can be exploited will be considered eligible for monetary rewards. The determination of whether a reported issue sufficiently meets the monetary rewards bar is made at the discretion of Sky Mavis,” the blog post added.

The hacking attack on the Ronin network was discovered by Sky Mavis on March 23, making the biggest loot ever extracted from a blockchain hack.

The attacker had hacked control of Sky Mavis’ four Ronin validators and a third-party validator operated by Axie DAO (Decentralized Autonomous Organization).

A judicial investigation is underway in this case.

Sky Mavis meanwhile raised $150 million (about Rs 1,142 crore) in a recent funding round led by crypto exchange Binance. The funds will be used to compensate victims of the Ronin bombing.

Overall, cybercriminals stole more than $1.3 billion (approximately Rs 9,606 crore) last year by hacking the blockchain industry, according to a report by blockchain research firm CertiK in January.