On February 23, 2024, the cryptocurrency community received a sobering reminder that no one is immune to wallet compromises. Jeff “Jihoz” Zirlin, co-founder of Axie Infinity and the Ronin Network, disclosed that two of his personal wallets had been hacked, with approximately 3,248 ETH — worth roughly $9.7 million at the time — stolen and routed through Tornado Cash. If a blockchain industry pioneer can lose nearly $10 million from personal wallets, the implications for everyday users are profound.
The Threat Landscape
The Jihoz breach is the latest in a growing pattern of targeted attacks against high-profile cryptocurrency holders. Unlike the $625 million Ronin bridge exploit of March 2022, which was attributed to North Korea’s Lazarus Group and involved a systemic network vulnerability, this incident was a personal wallet compromise. PeckShield, the blockchain security firm that traced the stolen funds, classified it as a “wallet compromise” — suggesting the attacker gained access to Zirlin’s private keys rather than exploiting a protocol vulnerability.
The attack vector remains undisclosed, but wallet compromises typically follow several well-established patterns. Phishing attacks, where victims are tricked into signing malicious transactions or revealing seed phrases, remain the most common method. Supply chain attacks, where malware is injected into seemingly legitimate software updates, represent a growing threat. Physical access to devices, social engineering of mobile carriers for SIM swaps, and exploitation of weak key management practices all contribute to the threat surface.
Core Principles
Securing cryptocurrency wallets requires adhering to several fundamental principles. The first is the concept of separation of concerns. Zirlin himself noted that the compromised keys had nothing to do with Sky Mavis operations, suggesting he maintained some separation between personal and business wallets. However, the breach of two wallets simultaneously suggests a common vulnerability in how both were secured.
The second principle is defense in depth. Relying on a single security measure — whether it is a hardware wallet, a multi-signature arrangement, or a specific software solution — creates a single point of failure. A robust security setup should layer multiple protections so that the compromise of any one element does not result in total loss. This means combining hardware wallets with strong passphrase protection, using dedicated devices for cryptocurrency operations, and implementing geographic redundancy for backup storage.
The third principle is operational security hygiene. This includes never reusing passwords across services, using dedicated email addresses for cryptocurrency-related accounts, enabling two-factor authentication on all exchange accounts, and being vigilant about the links you click and the software you install.
Tooling and Setup
For users looking to significantly improve their wallet security, the hardware wallet remains the gold standard for private key protection. Devices from established manufacturers like Ledger and Trezor store private keys in secure hardware elements that never expose them to the host computer. However, hardware wallets alone are not sufficient. Users must also protect their seed phrases using steel backup plates stored in secure, geographically distributed locations.
Multi-signature wallets add another layer of protection by requiring multiple independent devices or parties to authorize transactions. Services like Gnosis Safe (now Safe) allow users to configure wallets that require, for example, three out of five signers to approve any transfer. This means an attacker would need to compromise multiple independent devices to steal funds.
For those managing particularly large holdings, consider using a dedicated air-gapped computer — a device that has never been and will never be connected to the internet — for generating and storing private keys. This approach, while cumbersome, eliminates an entire category of network-based attacks.
Ongoing Vigilance
Security is not a one-time setup but an ongoing process. Users should regularly review their wallet connections, revoking unnecessary token approvals and smart contract permissions through tools like Revoke.cash. Transaction simulation tools, which preview what a smart contract interaction will do before it is executed, can prevent phishing attacks that trick users into signing malicious transactions.
Monitoring tools that alert users to outgoing transactions from their wallets can provide early warning of unauthorized access. Services like Forta, CertiK Skynet, and various blockchain monitoring platforms offer real-time alerts that can help users respond quickly in the event of a breach.
Final Takeaway
The Jihoz wallet hack demonstrates that experience and expertise in the cryptocurrency space do not provide immunity from personal security breaches. The $9.7 million loss, routed through Tornado Cash within hours of the theft, shows how quickly and irreversibly funds can move once a private key is compromised. Every cryptocurrency user, regardless of their technical sophistication, should treat wallet security as an ongoing practice rather than a solved problem. The tools and techniques exist to dramatically reduce risk — the challenge lies in consistently applying them.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Always conduct your own research before making investment decisions.
jihoz literally built ronin and still got his wallets drained. if the cofounder of a major chain can’t secure his bags, what hope do the rest of us have
nosleep_404 thats exactly why hardware wallets exist tho. you can phish a seed phrase but you cant phish a button press on a ledger
0xHardhat.eth you cant phish a hardware wallet button press but you CAN phish someone into signing a malicious transaction on a compromised machine. hardware helps but its not a silver bullet
0xHardhat.eth right, you cant phish a ledger button press. but you CAN social engineer someone into signing a malicious tx on the compromised laptop connected to that ledger
different threat model tho. high net worth individuals get targeted way more aggressively than regular users. you’re not getting a custom phishing attack built just for you
Boris L. has a point but the jihoz attack was probably a social engineering job with months of reconnaissance. regular users face spray and pray phishing, not custom attacks
social engineering for months just to drain personal wallets. the ROI on that attack vs effort tells you target lists exist and are being traded
key_rot_ months of social engineering for one target means the ROI was calculated. 9.7M from 3248 ETH divided by months of recon and infrastructure is still way above any day job. targeted lists are absolutely being traded
nosleep_404 the ronin cofounder getting drained is the ultimate wake up call. operational security is not optional regardless of who you are
nosleep_404 if the ronin cofounder gets drained what chance do regular users have. hardware wallets should be default not optional for anything above lunch money
$9.7M through tornado cash in one go. wonder how long before we see more sanctioned mixer alternatives pop up
tornado is just the onramp. funds usually end up on cex bridges eventually. the tracing game is just delayed not prevented
tornado cash delay is real but chainalysis flagged those funds within hours. the issue is CEX compliance teams vary wildly on acting on alerts
tornado cash routing is the standard playbook now. the real question is how long before CEXes start freezing downstream funds preemptively
3,248 ETH is life changing money even for a cofounder. multi sig with time locks should be non negotiable above 6 figures
Dara O. 3248 ETH on personal wallets without a multisig timelock is wild. you built a chain and didnt use the most basic self custody tool
multisig_please_ 3248 ETH on personal wallets without a timelock is the craziest part. the guy literally built ronin and skipped basic multisig on his own bags
seed_airgap_ 3248 ETH on personal wallets without multisig from the guy who built ronin. if sky mavis taught him anything it should have been that single-key custody fails at exactly the worst moment
seed_airgap_ 3248 ETH on personal wallets without a timelock from the guy who literally built Ronin. you cant make this up
if the guy who built ronin bridge gets his personal wallets drained, what hope do normies have. hardware wallet should be the bare minimum not a flex
nathan_r exactly. if the cofounder of ronin with actual security budget gets clipped via personal opsec, the local hot wallet user has zero chance. cold storage or bust at this point
3248 ETH on personal wallets from the guy who built ronin. the irony would be funny if 9.7M wasnt life changing money for most people reading this
3248 ETH stolen from one of the Ronin founders and the attack vector is still undisclosed. thats the scariest part. if Jihoz doesnt know how they got him, how are we supposed to protect ourselves
keysplit_advocate_ undisclosed attack vector is the worst part. if jihoz doesnt know how they got him after months of forensics then the threat model is incomplete for everyone
keysplit_advocate_ the fact that PeckShield classified it as a wallet compromise and not a protocol exploit means his opsec failed personally. probably phishing or signed a malicious payload. even founders click bad links