Ronin Bridge 🌉 Bridge

On March 23, 2022, an attacker drained 173,600 ETH and 25.5 million USDC — roughly $624 million at the time — from the Ronin Bridge, the Ethereum-based bridge underpinning the Axie Infinity game economy. Sky Mavis, the company behind Ronin, did not notice the theft for six days; it surfaced only after a user reported a failed withdrawal. The FBI later attributed the attack to North Korea's Lazarus Group and APT38.

How the attack worked

Ronin ran as a proof-of-authority sidechain with nine validator nodes; approving a withdrawal required signatures from five of them. Sky Mavis itself controlled four of those nodes, so compromising just one more validator — on top of its own four — was enough to move funds out of the bridge.

The entry point was not a smart-contract bug but a person. According to reporting on the incident, attackers posed as recruiters on LinkedIn and ran a senior Sky Mavis engineer through several rounds of a fake hiring process for a nonexistent company, culminating in an unusually generous offer sent as a PDF (The Block). Opening the document installed spyware that gave the attackers a foothold inside Sky Mavis's infrastructure and control over four of its validator nodes.

That left the attacker one signature short. It came from an unrelated shortcut: back in November 2021, Sky Mavis had let the Axie DAO sign transactions on its behalf via a whitelisted RPC node, to handle a surge of free-transaction demand during high network load. The arrangement was meant to be temporary and was never revoked. With four validator keys already in hand, the attacker used this still-active whitelist entry to forge the fifth signature and authorize two withdrawals — 173,600 ETH and 25.5 million USDC — straight out of the bridge contract (Rekt).

What happened next

Sky Mavis raised $150 million in a funding round led by Binance and used it to reimburse affected users; the company said full recovery of the stolen funds could take years. The validator set was later expanded from nine to eleven nodes, and the signature threshold was raised. In September 2022, Chainalysis and law enforcement traced and seized just over $30 million of the stolen crypto — about 5% of the total — which Sky Mavis said would go back into the Axie DAO treasury (Decrypt). The rest, laundered in part through Tornado Cash, remains unrecovered, and the wallet address tied to the theft was placed under U.S. Treasury sanctions. Axie Infinity itself survived, though its token economy never returned to pre-hack levels.

What this means

• Federated and multisig bridges are only as decentralized as their signer set. Ronin needed 5-of-9, but one operator effectively controlled four seats, so the real threshold for an attacker was "compromise one more party," not "break five independent ones."
• Temporary access grants are a durable attack surface. The decisive signature came from an unrevoked, four-month-old whitelist entry, not a fresh exploit. Any "temporary" permission that isn't tracked and expired is effectively a live key.
• The weakest link was social, not cryptographic. Recruiting-themed spear phishing against an engineer with validator access bypassed audits and code review entirely — no amount of smart-contract testing would have caught it.
• Detection lag compounded the damage. Six days passed between the theft and its discovery, and it surfaced through a user support ticket rather than monitoring. Bridges moving hundreds of millions warrant real-time balance and signature-anomaly monitoring, not manual checks.