Ronin Bridge Hack: Inside the $620M Axie Infinity Exploit

1. 1

   A routine withdrawal that wouldn't go through

   On an ordinary Tuesday, a user tried to withdraw 5,000 Ethereum from the Ronin Bridge. Rejected. He tried again — rejected again. When he contacted support, the technical team checked the database and everything looked normal. Then someone thought to check the balance of the bridge's smart contract itself. The pool was empty.

   

2. 2

   $620 million, gone since March 23

   The contract held 173,600 ETH and $25.5 million USDC — roughly $620 million that day. Both had been withdrawn six days earlier, and no one had noticed. No vault was cracked, no alarm went off, and no software vulnerability was exploited. The whole operation, it turned out, had begun months before — with a single job offer.

   

1. 3

   The game that became an economy

   In 2021, Axie Infinity was the biggest success story of play-to-earn: players raised, bred and battled cartoon creatures called Axies, earning tokens convertible into real money. In the Philippines, thousands of people earned a living this way — for some households it was the primary income during the pandemic. Daily active users climbed to 2.7 million, and every trade, battle and purchase inside the game became a transaction on Ethereum.

   

2. 4

   A sidechain, a bridge — and 5-of-9

   Ethereum mainnet fees made no sense for players earning a few dollars a day, so Sky Mavis, the studio behind Axie, built Ronin: a faster, cheaper sidechain connected back to Ethereum by a bridge. The bridge's rule was simple — nine validator nodes, at least five signatures per withdrawal, so no single party could move funds alone. But four of the nine nodes ran on Sky Mavis' own servers, and months earlier, to handle a traffic surge, Axie DAO had granted Sky Mavis a temporary signing authorization. The surge passed, the cooperation wound down — the authorization was never removed.

   

1. 5

   February 2022: a recruiter on LinkedIn

   Investigators tie the Lazarus Group to North Korea's military intelligence, and its financial-theft unit to some of the largest cyber heists on record — from Bangladesh Bank to exchanges worldwide. Their campaigns are known for patience: in some cases they spent close to a year inside a target's network before moving. In February 2022, a senior software engineer at Sky Mavis received a LinkedIn message from an apparent recruiter at a major tech company. Career opportunities, open positions — no files, no links. The same method, investigators would find, had been running for months across multiple targets.

   

2. 6

   Research before the hook

   Before a target was chosen, they were studied. Public profiles on LinkedIn and GitHub told the attackers who held smart-contract signing authority, whose career ambitions might be exploitable, and whose online presence suggested an openness to a new opportunity. Weeks passed. Interviews were scheduled, technical questions asked, salary expectations negotiated — a pipeline indistinguishable from a genuine hiring process.

   

3. 7

   The offer letter arrives

   At the end of it came an extraordinary offer: a salary far above market, generous benefits. After weeks of invested relationship-building, few people want to believe the person on the other end has bad intentions. The official offer letter landed in the engineer's inbox — and he opened it.

   

4. 8

   A backdoor named Manuscript

   The document rendered like a normal letter. Nothing seemed to happen. Quietly, in the background, a backdoor security tools detect as Manuscript (Backdoor:Win32/Manuscript!mclg) wrote itself into the system's startup files and established persistence. The attackers were now inside Sky Mavis' corporate network.

   

1. 9

   Hunting the validator keys

   From the infected computer, lateral movement began across the corporate network. The intruders searched password stores, developer documentation and server credentials — until they found what they came for: the servers holding the private keys of the four validator nodes controlled by Sky Mavis. Four of the five required signatures were now theirs. They needed one more.

   

2. 10

   The fifth signature, zero alarms

   This is where the forgotten authorization comes in. A node running Axie DAO's temporary signing permission was still active inside Sky Mavis' infrastructure — never revoked after the 2021 traffic surge ended. The attackers used it to obtain the fifth signature without triggering a single alarm. To the Ronin Bridge contract, nothing about the request looked wrong: the contract didn't ask who signed, only how many signatures there were.

   

3. 11

   March 23: two transactions

   With five signatures collected, the bridge did what it was built to do — release the funds. The first withdrawal moved 173,600 ETH. The second moved 25.5 million USDC. Both landed in a single wallet under the attackers' control. None of Sky Mavis' monitoring systems flagged it: there was no mechanism to even question a bridge-sized withdrawal. The attackers immediately swapped the USDC for ETH on decentralized exchanges, then waited six days. Nothing happened anywhere.

   

1. 12

   April 2022: the attribution

   In April 2022, the FBI and the US Treasury officially attributed the attack to the Lazarus Group, and the attacker's wallet was added to the sanctions list. By then the stolen assets were already moving: split into thousands of smaller transactions, routed through the privacy mixer Tornado Cash, shifted onto the Bitcoin network and mixed again through a separate service. When the US sanctioned Tornado Cash itself in August 2022, the attackers adapted — hopping between blockchains to make the trail longer and harder to follow with every jump.

   

2. 13

   Following the money on-chain

   Breaking the link between sender and receiver is what mixers promise — but moving that much money still leaves traces. Blockchain analysts tracked the flows across chains and exchanges, and the effort produced results: in September 2022, US authorities seized over $30 million in stolen funds linked to the hack, with Chainalysis' tracing among the inputs. It was a fraction of the total — most of the Ronin proceeds were never recovered — but it proved laundering at this scale is a race, not a guarantee.

   

3. 14

   Making players whole

   For Sky Mavis, the immediate test was users. The company raised a $150 million emergency fund led by Binance, with Animoca Brands, a16z crypto, Paradigm, Accel and Dialectic participating, alongside its own resources. User losses from the breach were fully reimbursed, and the bridge reopened under new guardrails. The Axie economy had survived the largest theft in DeFi history — on paper, at least.

   

4. 15

   Nine validators become twenty-one

   The structural fix changed the math of any future attack. Ronin raised its validator count from 9 to 21, spread across more independent operators, so no single company's network could again produce a quorum. Years later the network went further, migrating to a new architecture built specifically to isolate its security from exactly this kind of single point of failure — five signatures out of twenty-one is a different problem than five out of nine when four keys share a rack.

   

5. 16

   The lesson: process, not just code

   The Ronin Bridge heist became one of the most expensive lessons in crypto history, and its core isn't technical. A permission that isn't revoked when it expires can become, months later, the opening that drains a treasury. A system that counts signatures without asking who signed, and monitors withdrawals without thresholds, will approve the worst day of its life without a beep. And even the strongest cryptography is defenseless against a job offer that looks real — which is why, for companies and individuals alike, pausing before opening an unexpected file and verifying identity through a separate channel remains one of the strongest defenses there is.

   

Continue the Story