Wed, 06 Jul 2022 22:37:15 +0000

https://www.theblock.co/post/156038/how-a-fake-job-offer-took-down-the-worlds-most-popular-crypto-game

- payload delivered via a malicious pdf to a Sky Mavis employee that was applying for a new job

This gave access to 4 of the 9 private keys, only one more private key was needed

- the hackers managed to use the Axie DAO to complete the heist. The DAO allowlisted Sky Mavis to sign various transactions on its behalf. The allowlist access wasnt revoked, and once the attacker got access to Sky Mavis systems they were able to get the signature from the DAO validator.