The Ronin Bridge Hack Explained: $624M
Quick answer. In March 2022, attackers used five of Ronin's nine validator keys, four held by Sky Mavis, to drain $624M, per DefiLlama. Mapping key holders would have shown that; outflow alerts could have caught it before six days passed.
Video transcript
The largest bridge loss in DefiLlama's data needed no contract bug. The attacker held enough validator keys to sign the withdrawals.
On March 23, 2022, the attacker withdrew 173,600 ETH and 25.5 million USDC. DefiLlama puts the loss at 624 million dollars.
Sky Mavis ran four of nine validators. A spear-phished former employee's credentials reached all four nodes. The fifth came through a never-revoked Axie DAO allowlist. That made five of nine.
No one noticed for six days, until a user could not withdraw 5,000 ETH.
The FBI attributed the attack to the North Korea-based Lazarus Group. Sky Mavis raised 150 million dollars, and Ronin said all users were made whole when the bridge reopened.
Four lessons stand out. Count operators, not keys. Give temporary access an end date. Treat validator hosts as signing systems. And make detection a control, so large outflows page someone in minutes.
When it reopened, Ronin's bridge limited what stolen keys can take, with higher signature thresholds, human review for the largest withdrawals, a daily limit and a circuit breaker.
Ronin's loss ran through keys, permissions and people, the areas Guardian's OpSec Audit covers. You get a threat model of your funds and a ranked list of changes to make.
Read the full breakdown, or talk to Guardian at guardian.security about who holds your keys.
The Ronin bridge hack is the largest bridge loss in DefiLlama's data: $624 million, on March 23, 2022.
No contract bug was needed. Ronin's post-mortem said "all evidence points to this attack being socially engineered, rather than a technical flaw," Elliptic reported.
The attacker held enough keys to sign withdrawals the bridge accepted as valid. That is why an OpSec review starts by mapping who holds which key.
What Happened
Ronin is the Ethereum sidechain developed for Axie Infinity, the NFT game made by Sky Mavis.
On March 23, 2022, the attacker withdrew 173,600 ETH, then 25.5 million USDC, from the Ronin bridge, per Rekt.
No one noticed for six days. The team found the theft "after a report from a user being unable to withdraw 5k ETH from the bridge," Rekt reported.
Sky Mavis then said the signing bar would rise: "Moving forward, the threshold will be eight out of nine," per Rekt.
How the Attack Worked
The bridge had nine validators. Withdrawals needed five of their signatures, per Rekt.
Sky Mavis ran four of the nine. One company's systems held all but one of the signatures an attacker needed.
Four keys through one employee
Cointelegraph, summarizing Sky Mavis's April 27 post-mortem, called it "a spear-phishing attack on a former Sky Mavis employee."
The attacker used that employee's credentials to reach Sky Mavis's four validator nodes.
The Block later described the lure, citing two people with direct knowledge. A fake company approached Sky Mavis staff, through LinkedIn according to one source.
After several rounds of interviews, a senior engineer received a generous offer as a PDF. Downloading it let spyware into Ronin's systems, The Block's sources said.
The fifth key: a favor never revoked
In November 2021, under heavy user load, Sky Mavis asked Axie DAO for help distributing free transactions. Axie DAO allowlisted Sky Mavis to sign on its behalf.
"This was discontinued in December 2021, but the allow list access was not revoked," the post-mortem says, per Cointelegraph.
The post-mortem adds that the attacker "found a backdoor through our gas-free RPC node, which they abused to get the signature for the Axie DAO validator."
That made five of nine.
Timeline and Loss
| Date | Event | Source |
|---|---|---|
| Nov 2021 | Axie DAO allowlists Sky Mavis to sign on its behalf | Sky Mavis, via Cointelegraph |
| Dec 2021 | The arrangement ends; the allowlist access stays live | Sky Mavis, via Cointelegraph |
| Early 2022 | A fake company approaches Sky Mavis staff | The Block |
| Mar 23, 2022 | 173,600 ETH and 25.5M USDC withdrawn | Rekt; Sky Mavis |
| Mar 29, 2022 | Theft found after a user's withdrawal fails | Rekt |
| Apr 14, 2022 | OFAC adds the thief's address to Lazarus Group's entry | OFAC; Elliptic |
| Apr 27, 2022 | Post-mortem; validator set already up from nine to 11 | Cointelegraph |
| Jun 28, 2022 | Bridge reopens; Ronin says all users are made whole | Ronin |
The dollar loss depends on when the ETH is priced:
- DefiLlama: $624 million.
- Rekt: about $624 million.
- Elliptic: $540 million at the time of theft, and over $615 million at discovery.
We use DefiLlama's figure, as in our ranking of the biggest bridge hacks.
Reimbursement
Sky Mavis raised $150 million from investors including Binance, a16z and Paradigm to reimburse users, The Block reported.
When the bridge reopened, Ronin said: "All users have been made whole."
The Axie DAO treasury's missing 56,000 ETH would stay undercollateralized while Sky Mavis worked with law enforcement to recover it, Ronin said.
Attribution
The FBI attributed the attack to Lazarus Group, a North Korea-based, state-sponsored hacking group, Cointelegraph reported in April 2022.
On April 14, 2022, OFAC added an Ethereum address to Lazarus Group's sanctions entry. Elliptic identified it as the thief's address.
Our Lazarus Group playbook covers how the group works today.
What It Shows
Four lessons stand out from the record.
Count operators, not keys
Five of nine sounds distributed. Yet one company's systems plus one stale permission were enough.
Temporary access needs an end date
The Axie DAO arrangement ended in December 2021, a month after it began. Its allowlist access was never revoked, and the attacker used it for the fifth signature.
Validator hosts are signing systems
Four keys sat on nodes that one employee's credentials could reach. Engineers with that access are targets, as our guide to social engineering attacks on signers shows.
Detection is a control
Six days passed before a user's failed withdrawal exposed the loss. Large outflows from a bridge should page someone in minutes.
Ronin's reopened bridge added limits on what stolen keys can take, per its June 2022 post:
- 70% of validator signatures at the base tier.
- 90% for withdrawals of $1 million or more.
- 90% plus human review for $10 million or more.
- A daily withdrawal limit, starting at $50 million.
- A circuit breaker that halts large suspicious withdrawals.
For design controls on validators and routes, see our guide to cross-chain bridge security.
How Guardian's OpSec Audit Maps This
Ronin's loss ran through keys, permissions and people. Those are the subject of Guardian's OpSec Audit.
Its first area is the threat model: the contracts that hold your funds, the roles that can move them, and the keys, signers and multisigs behind each one.
Ronin's gaps line up with the audit's other areas:
| In Ronin's record | Audit area | What the area covers |
|---|---|---|
| Four of nine validator keys at one company | Custody and key ceremony | Who holds which share, and what a quorum requires in practice |
| A temporary Axie DAO allowlist left live | Privileged roles | Who can move funds, behind a threshold or a single key |
| Credentials that reached four validator nodes | Access and change control | Access across every system, and separation between environments |
| A fake job offer to a senior engineer | People and response | Single points of failure, and whether incident runbooks hold up |
You receive the threat model of your funds and a ranked list of changes to make, each tied to the path it closes.
Paired with Managed Security, that threat model stays current, with every multisig transaction and deployment reviewed as it lands.
Frequently Asked Questions
How much was stolen in the Ronin bridge hack?
173,600 ETH and 25.5 million USDC, per Rekt. DefiLlama records $624 million. Elliptic valued the haul at $540 million at the time of theft and over $615 million when it was found six days later.
Who was behind the Ronin bridge hack?
The FBI attributed the attack to Lazarus Group, a North Korea-based, state-sponsored hacking group, Cointelegraph reported. On April 14, 2022, OFAC added the thief's Ethereum address to Lazarus Group's sanctions entry, Elliptic noted.
How did attackers get five Ronin validator keys?
Four sat on Sky Mavis's validator nodes, reached with a spear-phished former employee's credentials, Cointelegraph reported. The fifth came through Axie DAO: an allowlist letting Sky Mavis sign on its behalf, set up in November 2021, was never revoked.
Were Ronin users reimbursed?
Yes. Sky Mavis raised $150 million to reimburse users, The Block reported. At the June 28, 2022 reopening, Ronin said all users were made whole; the Axie DAO treasury's missing 56,000 ETH awaited recovery.
Sources
- DefiLlama: Hacks dataset API (read November 6, 2026)
- Rekt: Ronin Network, Rekt (March 29, 2022)
- Elliptic: North Korea's Lazarus Group identified as exploiters behind $540 million Ronin bridge heist (March 29, 2022, updated)
- Cointelegraph: Plan for $1M bug bounties and double the nodes in wake of $600M Ronin hack (April 28, 2022)
- The Block: Sky Mavis plans to become a 'zero-trust organization' after $600 million Ronin hack (April 27, 2022)
- The Block: How a fake job offer took down the world's most popular crypto game (July 6, 2022)
- OFAC (US Treasury): North Korea Designation Update (April 14, 2022)
- Ronin: The Ronin Bridge Is Open (June 28, 2022)
- Guardian: OpSec Audit
- Guardian: Managed Security
Know who holds your keys
Guardian maps every path to your funds and reviews how your team actually holds, approves and changes them.