Ronin Network (Axie Infinity) Hack 2022 — $625M Exploit Analysis

North Korean Lazarus Group compromised 5 of 9 Ronin validator private keys, enabling unauthorized withdrawals from the bridge.

Details

• Date: 2022-03-23
• Amount Lost: $625,000,000
• Chain(s): Ronin, Ethereum
• Category: Bridge
• Technique: Private Key Compromise
• Status: Partially Recovered
• Amount Recovered: $30,000,000

Full Description

Attackers compromised 4 Sky Mavis validator keys and 1 Axie DAO validator key through a spear-phishing attack on a Sky Mavis employee. With 5/9 signatures, they drained the Ronin bridge in two transactions. The hack went undetected for 6 days until a user reported inability to withdraw funds.

Laundering Analysis

ETH sent to Tornado Cash mixer in batches. Some funds routed through Blender.io (later sanctioned). A portion converted to BTC via RenBridge. US Treasury sanctioned associated Ethereum addresses. Approximately $30M recovered by US DOJ in 2022.

Sources

• https://roninblockchain.substack.com/p/community-alert-ronin-validators
• https://rekt.news/ronin-rekt/

Transaction Hashes

• 0xc28fad5e8d5e0ce6a2eaf67b6687be5d58113e16be590824d6cfa1a94467d0b7

Related Hacks

• Poly Network — 2021-08-10 — $611M
• BNB Chain Bridge (BSC Token Hub) — 2022-10-07 — $570M
• Wormhole — 2022-02-02 — $320M
• Mixin Network — 2023-09-23 — $200M
• Nomad Bridge — 2022-08-01 — $190M

Back to Browse