The Stake hack: $41 million in nine hours, and the vault that provably fair does not cover

12:48 UTC

Stake is, by most measures, the largest crypto casino in the world, and on 4 September 2023 its Ethereum hot wallet did something hot wallets do fifty thousand times a day: it signed a transfer. This one sent about $3.9 million of USDT to an address nobody at the company controlled. Two more transfers followed within minutes, moving over 6,000 ETH — about $9.8 million at the time — and then a run of smaller ones emptying out the stablecoins and tokens that were left: USDC, DAI, and on two other chains, BNB and MATIC.

Analysts who watch the chains noticed before the casino announced anything. PeckShield’s first estimate, covering Ethereum alone, was $15.7 million; ZachXBT pointed out that the same actor had drained about $25.6 million more from Stake’s BNB Chain and Polygon wallets; Beosin’s reconciled total was $41.35 million. Etherscan labelled the receiving address “Stake.com Hacker” while the transfers were still landing.

Bitcoin, Litecoin, XRP, EOS and TRON wallets were not affected. Figures are 4 September 2023 prices as reported by the tracing firms.

What was touched, and what was not

Stake’s first public post said unauthorised transactions had been made from its ETH and BSC hot wallets, that the wallets were being investigated, and that user funds were safe. Deposits and withdrawals on the three affected chains were paused; everything else kept running. At 21:28 UTC the company announced that all services had resumed — under nine hours after the first transfer, and a few hours after the public acknowledgement.

Co-founder Ed Craven described the attack as a sophisticated breach of a service the casino used to authorise transactions, and said private keys were not compromised — the attacker had been able to make “several unauthorised transactions” from the hot wallets rather than take the wallets themselves. Several security researchers disagreed in public: to them, a stranger signing valid transfers from your address is the definition of a key compromise, whatever the key was wrapped in. The dispute is less about facts than about vocabulary. A signing service holds, or can reach, the authority to spend; whoever controls the service controls the money, and for about ten minutes somebody else did.

• Not touched: the games. No seed was leaked, no result was altered, no bet was paid wrong. Every round played that day verifies today exactly as it did then.
• Not touched: the cold storage. The Bitcoin, Litecoin and XRP balances — the bulk of a casino’s float — sat elsewhere and never moved.
• Touched: the operational float. The money a casino keeps hot so that withdrawals clear in minutes. $41 million is a large hot balance; it is also a fraction of what a site of that size turns over in a day, which is why the casino could absorb it and pay withdrawals as if nothing had happened.

Days later, a name

Attribution came faster than it usually does. Within the week the FBI said its investigation had revealed that DPRK cyber actors — the Lazarus Group, which it also tracks as APT38 — had moved the stolen funds from Stake’s Ethereum, BNB Chain and Polygon wallets, and it published the addresses the group was using so that exchanges could refuse the money. The same bulletin put the group’s 2023 haul at more than $200 million: about $100 million from Atomic Wallet in June, $60 million from Alphapo and $37 million from CoinsPaid in July, and now Stake.

The laundering followed the pattern the group has used since the Ronin bridge theft a year earlier: funds bridged chain to chain, consolidated on Avalanche, swapped into wrapped bitcoin and then into native bitcoin, where tracing gets harder and the sanctioned mixers do the rest. None of the $41 million has been recovered, and none was expected to be. A casino that is hacked by a state does not get its money back; it gets a press release.

The FBI investigation has revealed that DPRK cyber actors moved stolen funds associated with the Ethereum, Binance Smart Chain and Polygon networks from Stake.com.FBI public service announcement, September 2023

Two promises, and only one of them is provable

Stake was one of the sites that made “provably fair” a standard, and its games were provably fair on 4 September 2023 in the morning, during the theft and after it. That is not irony; it is the lesson. A provably fair system makes one promise: the result of each round is fixed by a committed seed before you bet, and you can recompute it afterwards. What a hash commitment proves is exactly that and nothing more. It says nothing about who can spend the balance you won.

Custody is a second promise, made in a different language. It is a statement about keys, signing services, cold storage ratios and the people and software allowed to touch them — and none of it can be verified from the outside by a player, because a casino that published its signing architecture would be publishing a map for the next Lazarus. The best a site can do is behave well when it is tested, as Stake did: say what happened, keep paying, and not touch the one thing that was provable.

What a player can do is arithmetic, not cryptography. A balance left on any site is a loan to its hot wallet. Keep on the site what you intend to play, withdraw what you do not, and read what the withdraw window checks before it sends so that a pause looks like what it usually is — a check — rather than a theft. The seeds you can verify. The vault you can only size.