How Did the Ronin Bridge Hack Happen?

The 2022 Ronin Bridge hack is one of the largest crypto thefts ever, and one of the most instructive. It didn't rely on an exotic code bug. It combined too few gatekeepers, an access permission nobody removed, and a fake job offer.

What Ronin Was

Ronin is a blockchain built for the game Axie Infinity, which was hugely popular at the time. A bridge connected Ronin to Ethereum, letting players move assets between the two networks. Withdrawals from the bridge required approval from validators, much like signatures on a multisig wallet.

The Weak Point: Five Signatures Out of Nine

The bridge had nine validators, and any five could approve a withdrawal. Four of those validators were run by Sky Mavis, the company behind Axie Infinity. Earlier, to handle heavy traffic, Sky Mavis had also been given permission to sign on behalf of a fifth validator, and that temporary arrangement was never revoked.

How the Attackers Got In

According to later reporting, the attackers approached a Sky Mavis engineer with a fake job offer and a document that installed malware when opened. That foothold eventually gave them control of the four Sky Mavis validator keys plus the leftover permission for the fifth, exactly the five signatures needed. This is the same fake recruiter pattern that still targets developers.

How Much Was Taken

In March 2022, the attackers approved two withdrawals worth around $620 million in ETH and USDC at the time.

Why No One Noticed for Days

The theft went unnoticed for about six days, until a user reported being unable to withdraw. The lack of real-time monitoring turned a serious breach into a much longer head start for the attackers.

Who Was Behind It

The FBI attributed the attack to the Lazarus Group, a hacking group linked to North Korea, which has been tied to many major crypto thefts since.

How Users Were Made Whole

Sky Mavis raised new funding and committed to reimbursing affected users. The bridge later reopened with more validators and stronger security measures.

Lesson One: Count the Real Gatekeepers

Nine validators sounded decentralized, but one company effectively controlled enough of them to approve anything. How many signers a multisig requires matters less than who actually controls them.

Lesson Two: Remove Temporary Access

The permission that completed the attack was meant to be temporary. Forgotten access is one of the most common security gaps anywhere.

Lesson Three: People Are Part of the Attack Surface

The breach began with a job offer, not a code flaw. Bridges attract high-value attacks, and attackers will target whoever holds the keys.

Check a bridge's validator setup and track record before moving significant funds.