The Ronin Bridge Hack (2022): How $600 Million Left Axie Infinity

In March 2022 the Ronin Network, the blockchain behind the game Axie Infinity, lost about 173,600 ether and 25.5 million USDC to an attack on its bridge. At the time it was the largest theft in decentralised finance, and it was later attributed to hackers linked to North Korea. The incident shows how security can depend on a handful of keys.

What Ronin was

Axie Infinity, made by the Vietnamese studio Sky Mavis, was a game in which players collected creatures and could earn tokens. To make transactions cheap and quick, Sky Mavis built Ronin, a separate blockchain, or sidechain, linked to Ethereum. Players and others moved assets between the two with a bridge: users deposited funds on Ethereum, and equivalent tokens were released on Ronin, and the process worked in reverse for withdrawals.

How the bridge was secured

Ronin relied on a set of nine validator nodes. A withdrawal needed signatures from five of the nine. That design is a simple threshold scheme, and its security depends on how many validators an attacker can control. Sky Mavis ran four of the validators. A fifth, belonging to the Axie DAO, had been given permission to sign on Sky Mavis's behalf in late 2021 to deal with heavy traffic. That arrangement was temporary, but the permission had not been revoked.

The attack

According to Sky Mavis's own post-mortem, the attacker compromised Sky Mavis systems and obtained the keys for the four validators it controlled. They then used the leftover permission to get a signature from the Axie DAO validator. With five of nine signatures, the attacker could approve withdrawals that the bridge treated as valid.

Sky Mavis said an employee had been targeted through a fake job offer sent on a professional networking site. The employee was led through several rounds of interviews and then received a document, which, once opened, installed malware. This is a type of social engineering attack, which relies on deceiving a person rather than breaking cryptography.

The theft took place on 23 March 2022 in two transactions. The company only found out on 29 March, after a user reported being unable to withdraw 5,000 ether. That gap of almost a week meant the attackers had time to move the stolen assets.

Attribution and response

• On 14 April 2022, the US Federal Bureau of Investigation attributed the theft to Lazarus Group and APT38, hacking groups associated with North Korea. The US Treasury's sanctions office added a related wallet address to its sanctions list.
• Sky Mavis raised 150 million dollars in funding, led by the exchange Binance, to repay affected users.
• The bridge was reopened in June 2022 with more validators and additional security measures.
• Law enforcement and blockchain analytics firms later recovered a small part of the stolen funds.

Why bridges are targets

A bridge holds a large pool of assets on one chain while issuing claims on another. That makes it an attractive single target. Industry reports have counted bridge exploits among the largest categories of crypto theft in 2021 and 2022. Common weaknesses include:

1. Few signers. A small validator set means a small number of keys to steal.
2. Concentrated control. If one organisation runs most validators, compromising that organisation compromises the bridge.
3. Stale permissions. Temporary access that is never removed becomes a hidden risk.
4. Weak monitoring. A large withdrawal should trigger alerts quickly.

Why it took six days to notice

The funds were taken on 23 March, but the company only learned of it on 29 March. That gap is itself a finding: nobody was alerted when a very large withdrawal left the bridge, and ordinary users found the problem first. Good practice is to set automated alerts for unusual withdrawals and to rehearse who responds and how. Staff training matters just as much, and practical hosting guides are available in our knowledge base. Employees at technology firms are regularly approached by recruiters on professional networks, and a convincing job process is a common cover for delivering malware. Companies reduce the risk by giving sensitive roles separate work devices, limiting what attachments can be opened and requiring that all job-related files be handled in isolated environments.

Fixes and design lessons

Keeping the figures in perspective

The value of the theft, widely reported as about 600 million dollars, depends on the price of ether on the day. The amounts of ETH and USDC are the stable facts. The Ronin case also shows that blockchain security is only as strong as the surrounding human and operational practices.

A practical lesson for site owners

Phishing with a fake job offer worked on a technical employee at a well-funded company. The same applies to your site administrators: use separate accounts, strong passwords, and two-factor sign-in, and remove access when it is no longer needed. The security page explains protections that Zebra Hosting provides.