Axie Infinity, a major play-to-earn (P2E) blockchain game, has posted a tweet to alert gamers of a fresh hacking attempt involving its Discord bot MEE6. The MEE6 bot is a commonly used Discord bot by several projects to automate various roles and messages. As mentioned in Axie Infinity’s tweets, the attackers took control of the MEE6 bot, which was installed on the main server, and used the bot to add permissions to a fake Jiho account. The hackers then used the account to spread the news about a fake mint.
The team was able to eliminate the fraudulent messages as well as the compromised MEE6 bot from the main server. They cautioned that many users may continue to see the fake message until they restart Discord.
2/ The announcements have been deleted but some users may still see the message until they restart their Discord.
We have removed the Mee6 bot from the server and will never do a surprise mint.— Axie Infinity???????? (@AxieInfinity) May 18, 2022
4/ This was not unique to Axie and happened to many servers with the Mee6 bot installed.
— Axie Infinity???????? (@AxieInfinity) May 18, 2022
Similar concerns plagued several projects that have the MEE6 bot installed on their servers. The admin accounts of RTFKT, PROOF/Moonbirds, PXN, Memeland, and Cool Cats, and some others have been compromised.
Some servers have reported MEE6 being used to post unwanted messages. There is no technical breach in our systems. This was due to one of our employee’s account getting compromised.
✅ The issue is now fixed and we’ve taken all the steps to make sure it never happens again.
— MEE6 (@mee6bot) May 18, 2022
The official MEE6 account on Twitter later clarified that there was no technical breach in their systems, but one of their employee’s accounts was compromised. The MEE6 team stated that the issue is now fixed and they will make sure things like this will not happen again.
That said, what message the attackers published is unclear and so is the scale of the attack.
The P2E game community’s faith in Axie Infinity appears to be shaken by a series of security breaches. The breach of the Discord bot comes less than a month after one of the largest heists on Axie Infinity’s Ronin bridge, which resulted in the loss of over $625 million (roughly Rs. 4,856 crore) in crypto assets. Known to be the biggest hack in the history of crypto, Axie Infinity’s Ronin Bridge exploit accounted for half of all the crypto attacks that took place throughout the first quarter of 2022.