$625M vanished from Ronin Bridge on March 23, 2022. Nobody noticed for 6 days.
Axie Infinity wasn't just a game—it was income for entire Filipino guilds. Ronin was their highway to Ethereum.
The bridge required 5 of 9 validator signatures to approve withdrawals. Simple. Clean.
Except someone already had 5 keys.
4 belonged to Sky Mavis. The 5th? An Axie DAO validator that got temp access during high traffic. Access was never revoked.
The bridge didn't break. It saw 5 valid sigs and executed:
• 173,600 $ETH
• 25.5M $USDC
Then silence.
Money sat untouched for 6 days until a user tried withdrawing 5K $ETH and the bridge couldn't process it. That's when Sky Mavis realized they'd been drained.
FBI traced it to Lazarus Group—North Korea's elite hacking unit.
The entry point? A senior engineer got socially engineered through a fake job offer and a malicious PDF.
Axie's economy collapsed overnight. Guilds went dark. Sky Mavis raised $150M to reimburse users and patched the bridge with more validators.
But here's the brutal truth:
The smart contract worked perfectly. The bridge followed its own rules. 5 of 9 keys opened the vault.
And for 6 days, the blockchain was screaming the truth on-chain.
Almost nobody was watching.
This wasn't a code exploit. It was a social engineering masterclass that exposed the human layer behind every "trustless" system.
Multisigs are only as secure as their weakest keyholder.
Axie Infinity wasn't just a game—it was income for entire Filipino guilds. Ronin was their highway to Ethereum.
The bridge required 5 of 9 validator signatures to approve withdrawals. Simple. Clean.
Except someone already had 5 keys.
4 belonged to Sky Mavis. The 5th? An Axie DAO validator that got temp access during high traffic. Access was never revoked.
The bridge didn't break. It saw 5 valid sigs and executed:
• 173,600 $ETH
• 25.5M $USDC
Then silence.
Money sat untouched for 6 days until a user tried withdrawing 5K $ETH and the bridge couldn't process it. That's when Sky Mavis realized they'd been drained.
FBI traced it to Lazarus Group—North Korea's elite hacking unit.
The entry point? A senior engineer got socially engineered through a fake job offer and a malicious PDF.
Axie's economy collapsed overnight. Guilds went dark. Sky Mavis raised $150M to reimburse users and patched the bridge with more validators.
But here's the brutal truth:
The smart contract worked perfectly. The bridge followed its own rules. 5 of 9 keys opened the vault.
And for 6 days, the blockchain was screaming the truth on-chain.
Almost nobody was watching.
This wasn't a code exploit. It was a social engineering masterclass that exposed the human layer behind every "trustless" system.
Multisigs are only as secure as their weakest keyholder.