Axie Infinity CEO Moved Crypto Tokens Before the Company Revealed Hack

This spring, Sky Mavis, the startup that makes the video game Axie Infinity, announced it had suffered a devastating hack. While most video games are primarily recreational, Axie Infinity’s popularity relied largely on its players’ ability to trade and earn crypto tokens that had financial value, and players had stashes that represented significant savings. The hack forced the Vietnam-based game developer to shut down its system for pulling tokens out of the game, essentially freezing the assets of its users before they could react to the news. 

Most of them, anyway. In the hours before the announcement and freeze, a digital wallet belonging to its chief executive officer and co-founder, Trung Nguyen, made a large transaction that included about $3 million worth of Axie Infinity’s main token, AXS. The tokens moved from ’s blockchain—a digital LEDGER for recording transactions—to the crypto exchange Binance. Although the transfer was visible to anyone with an internet connection, there’s nothing about the wallet that directly connects it to the person controlling it, as is true of most crypto transactions. But after being presented with an analysis of public data that seemed to link the wallet to Nguyen, Sky Mavis confirmed that he controlled it.   

The unusual activity took place during a moment of acute stress for Sky Mavis. For months, the first version of its game had been showing signs of steep decline, and many players were losing faith. The company was rushing to get the new version of Axie Infinity out when hackers on March 23 drained its system of cryptocurrencies that were worth over $600 million at the time. It was one of the biggest cyberattacks in the history of crypto. 

Anyone who knew what was going on would have had a strong incentive to sell tokens in the system before they were temporarily locked up, and moving them to the BINANCE exchange would have been a necessary first step toward cashing them out. But Sky Mavis says that this wasn’t the reason Nguyen made the transfer. In emails, Kalie Moore, a company spokeswoman, said that Nguyen had been working to shore up the company’s finances during the crisis, and had to do so in way that wasn’t obvious to the broader crypto market, for the good of the overall Axie Infinity economy. By moving AXS to the exchange, said Moore, the company could provide liquidity to its users as it restored access to funds via Binance. 

“At the time, we (Sky Mavis) understood that our position and options would be better the more AXS we had on Binance. This would give us the flexibility to pursue different options for securing the loans/capital required,” she wrote. “The Founding Team chose to transfer it from this wallet to ensure that short-sellers, who track official wallets, would not be able to front-run the news.”She said that any suggestion of other motives would be “baseless.” 

After this story was published, Nguyen posted a series of tweets reiterating Moore’s points. “My life's work is Axie Infinity and the community we've created together,” he wrote. “I take ownership of the security breach, and will use it as a learning experience.” 

Sky Mavis soon got access to much more money from investors. On April 6, the company announced it had raised $150 million to help reimburse users and recover from the attack. Sky Mavis has reopened the system for depositing and withdrawing funds. Since the hack was announced, the value of an AXS token has fallen from around $64 to $17.

The analysis of the pre-announcement transaction was conducted by someone who runs a small YouTube channel dedicated to crypto-based gaming, and who asked to be identified only by his screen name, , citing fear of retaliation. He shared his documentation with Bloomberg Businessweek, which worked with Kristen and Zach Abernathy, associate professors of mathematics at Winthrop University with expertise in blockchain analysis, to independently confirm the details. 

Sky Mavis has said it first learned about the hack when a large transaction failedabout 22 hours before its announcement of its response. During that period, a wallet moved 48,838 AXS tokens off Ronin, the special blockchain associated with the game. This was an unusually large transaction. By the Abernathys’ calculations, the total volume on Ronin for an average day this year was just over 55,000 AXS.

Asobs began his analysis by trying to determine who had made the transaction. The wallet was identified only by a long string of characters starting with 0x113c. But Asobs connected it to Nguyen by triangulating several pieces of online data. For example, he identified an initial distribution of tokens made to people involved with Axie Infinity in November of 2020, and assumed some of the wallets receiving those distributions would be controlled by the founders. He concluded that the 0x113c wallet that received the largest of those initial payments was likely that of the CEO. Then he looked for clues connecting those wallets to specific people, such as public tweets and transactions with other accounts attached to screen names. 

Asobs also examined other wallets that he thinks belong to Sky Mavis employees, because they received AXS from Sky Mavis with paycheck-like regularity. Several made large transactions during the same period that the 0x113c wallet moved out its tokens. Bloomberg Businessweek showed links of these transactions to Moore, the Sky Mavis spokeswoman. She said the company wouldn’t confirm the wallets belonged to Sky Mavis employees and described any suggestion that they did as speculation, noting that contractors and business partners may also receive tokens. “Sky Mavis routinely tracks on chain transactions for employees and after reviewing, believes anyone who sold after the incident, but before the bridge was closed, sold due to [AXS] increasing 49% in price over a short period of time prior to the breach being discovered,” she wrote.  

Asobs says he’s open to new information that could provide a better idea of what had happened. “We can see the money moved,” he says. “The only question is what happened behind the money moving.”