Ronin Network Hack: 7 Lessons From the $625 Million Bridge Theft

Try a quick self-test before you read about the Ronin Network hack. Can you name every outside party that can still sign or approve actions in your systems? Did you remove the access you granted for last year's short project? If either answer is "not sure", this report is for you.

In March 2022, attackers took 173,600 ETH and 25.5 million USDC from the Ronin bridge, the link between the Axie Infinity game network and Ethereum. The Ronin Network hack was not a clever math trick. It came from a phished employee, a forgotten permission and a missing alarm.

This lessons-learned report covers:

• What Ronin was and why its bridge held so much money
• A dated timeline from the theft to the bridge reopening
• How the attacker reached five of the nine validator keys
• Who was blamed, and which claims are confirmed versus reported
• Seven lessons you can apply to any company or wallet

What Was the Ronin Network Hack?

Ronin is an Ethereum sidechain. It was built by Sky Mavis, a Singapore-based studio that also owns Axie Infinity, a play-to-earn game based on NFTs. Reuters reported that Axie Infinity was then the biggest NFT collection by all-time sales, according to the tracker CryptoSlam.

Players moved coins between Ethereum and Ronin through a bridge. A bridge locks your coins on one chain and releases matching coins on the other. That means the bridge contract ends up holding a large pool of real assets. Whoever controls its release rule controls the pool.

Ronin's release rule was simple. Nine validators watched the bridge, and any withdrawal signed by five of them was accepted. In the Axie Infinity hack, the attacker gathered five valid signatures and signed two withdrawals to themselves. To the bridge, those looked like normal, approved requests.

Ronin Bridge Hack Timeline

The dates below come from the Ronin team's own community alert and update log, plus later reporting. Pakistan is five hours ahead of UTC, so most of these announcements reached readers here on the same calendar day.

How Did Attackers Get Five of Nine Validator Keys?

The Sky Mavis post-mortem describes the path in plain terms. Staff had faced repeated spear-phishing on social channels, and one employee was compromised. That person no longer works at the company. From that foothold, the attacker moved into Sky Mavis IT systems and reached the validator nodes.

Sky Mavis ran four of the nine validators. Four keys were one short of the five needed. The fifth came from an old favor. In November 2021, Sky Mavis asked the Axie DAO to help hand out free transactions during heavy traffic. The DAO allowlisted Sky Mavis to sign on its behalf. The program stopped in December 2021, yet nobody removed the permission.

Sky Mavis also ran a gas-free RPC node, a service that relayed those free transactions. The post-mortem calls it a backdoor. Through it, the attacker obtained the Axie DAO validator's signature. With five signatures in hand, the forged withdrawals passed.

Notice what did not happen. Nobody broke the bridge's cryptography, and no smart contract bug was needed. The validator keys worked exactly as designed. The weakness was in who held them and how many of them sat under one company's roof.

The Fake Job Offer: Reported, Not Officially Confirmed

In July 2022, The Block reported how the phishing may have worked. Two people with direct knowledge told the outlet that a fake company approached Sky Mavis staff, partly through LinkedIn. A senior engineer went through several interview rounds and received a generous offer as a PDF file. Opening it reportedly let spyware into Ronin's systems.

Treat this as credible reporting, not an admitted fact. Sky Mavis declined to tell The Block how the attack was carried out. Its own post-mortem confirms spear-phishing and a compromised employee, but it does not mention a job offer. This kind of fake job offer scam is a known pattern, and it is worth training against whatever the exact Ronin details were.

What Was Lost: Coins, Dollars and Six Days

The coin amounts are consistent across sources: 173,600 ETH and 25.5 million USDC. The dollar figure is not, and the reason is simple. ETH's price moved between the theft and the disclosure.

Reuters said the stolen coins were worth about $540 million on the day of the attack and almost $615 million when Ronin disclosed it. The FBI later cited $620 million in Ethereum, and many outlets used about $625 million. All of these describe the same coins. They differ only in which day's price was used. Reuters also quoted the analytics firm Elliptic, which called it the second-largest crypto theft on record at the time.

The figure that matters most for defenders is six days. The theft happened on 23 March and was found on 29 March, and only because a user's 5,000 ETH withdrawal failed. Sky Mavis admitted it had no proper system for tracking large outflows from the bridge.

Who Was Blamed, and How Firm Is That Attribution?

On 14 April 2022, the FBI said that "Lazarus Group and APT38, cyber actors associated with the DPRK" were responsible, as BleepingComputer reported. On the same day, the US Treasury's Office of Foreign Assets Control added the Ethereum address that received the funds to the Lazarus Group entry on its sanctions list.

That is an official government attribution, which places it above an analyst's opinion. Still, the FBI did not publish its full evidence. Blockchain tracing by Chainalysis supports the link, because the money moved in ways that matched earlier North Korean cases. Here is how to sort the claims:

• Confirmed by Sky Mavis: five keys used, spear-phishing of an employee, the unrevoked allowlist, the six-day detection gap.
• Stated by the US government: Lazarus Group and APT38 responsibility; the sanctioned address.
• Reported by anonymous sources: the LinkedIn approach and the PDF job offer.

The Lazarus Group name comes up again in our Bybit hack case study and in the Bangladesh Bank heist. The targets changed, but the habit of attacking people before systems stayed the same.

Following the Stolen Money: Mixers, Bridges and a $30 Million Seizure

Most of the stolen funds stayed in the attacker's wallet at first, according to Reuters. Over the following months, the money was laundered. On 8 August 2022, the US Treasury sanctioned the Tornado Cash mixer. The Block reported that Treasury accused it of laundering more than $455 million for Lazarus, and listed Ronin among the hacks linked to it.

On 8 September 2022, Chainalysis said it had helped US law enforcement seize about $30 million from the Ronin theft. The Block quoted Chainalysis calling it the first seizure of crypto stolen by a North Korean hacking group. It also described the route: ETH bridged to BNB Chain, swapped into another token, then bridged again. By our math that is roughly 5% of the total, so most of the money was never recovered.

What Sky Mavis Changed After the Ronin Network Hack

Users were promised full repayment. The $150 million round led by Binance, with Animoca Brands, a16z, Dialectic and Paradigm, plus company funds, was set aside for that purpose. The bridge stayed closed for about three months while the team rebuilt it.

The post-mortem lists the main fixes:

• The signing threshold rose from 5 of 9 to 8 of 9 straight away.
• The validator set grew to 11 by late April, with a target of 21 and, long term, more than 100.
• Large withdrawals would need a human to approve them.
• Staff got work-only devices and stronger security training, with a goal of zero-trust access.
• A bug bounty of up to $1 million was announced.
• Nodes moved to new infrastructure, and two outside audits were carried out.

Seven Lessons for Crypto Bridge Security

Each lesson below ties to a specific failure in the record. None needs special crypto knowledge. Most apply to a bank, a software house or a small online store as much as to a bridge.

1. Count who really holds the keys. Five of nine sounds spread out. In practice, one company held four keys and had a path to a fifth. Map key holders by organization and by system, not by name on a list.
2. Expire every temporary permission. The Axie DAO allowlist outlived its purpose by about four months. Give every special access a written end date and a named owner who removes it.
3. Alert on large outflows within minutes. A simple rule, such as "page a person when more than a set amount leaves", could have cut six days to minutes.
4. Add a human check for unusual size. Sky Mavis now requires human approval for very large withdrawals. A short delay is cheap compared with an empty bridge.
5. Treat job offers and files from strangers as a security event. Senior engineers are high-value targets. Open unexpected documents on a separate device, and keep work machines for work only.
6. Separate the systems that touch keys. One phished laptop should never lead to signing servers. Network separation and zero-trust checks limit how far one mistake travels.
7. Practice your response before you need it. Ronin had to pause the bridge, call exchanges, rotate validators and hire forensics teams in days. A written plan and contact list make those steps faster.

If these lessons sound familiar, that is the point. Our Binance hack explainer and WannaCry ransomware myths post reached similar conclusions about patching, monitoring and planning.

What Does the Ronin Network Hack Mean for Pakistan?

Pakistan is building rules for this sector. Dawn reported in July 2025 that the government announced the Pakistan Virtual Assets Regulatory Authority to license and supervise crypto service providers. Its listed duties cover money laundering controls and reducing cyber risk. As local exchanges and wallet firms seek licenses, questions like "who holds your signing keys" will become audit questions, not theory.

The people lesson matters even more here. Many Pakistani developers and freelancers job-hunt on LinkedIn and accept remote work from abroad. That makes the fake recruiter pattern a direct risk for them and for the companies they work for. A test file from a "client" deserves the same care as one from a stranger.

If you hold crypto yourself, the takeaway is practical. A bridge or exchange can fail even when your own password is strong. Keep only what you need on any single platform, and learn the warning signs on your own devices with our guide on how to tell if your phone is hacked.

Turning the Ronin Case Into Lab Practice at PSTA

Reading about an incident is a start. Working through it step by step in a safe lab is where it sticks. PSTA's Cyber Security & Ethical Hacking Course is a 12-week program designed for beginners with no prior security background. The course page lists labs on recognizing phishing and social engineering, configuring firewalls and intrusion detection, and investigating an incident while documenting a timeline. Those are the same skills this case calls for.

Classes run online for learners across Pakistan, or on our Abbottabad campus at Mandian, Old College Road. Your final task is a case-study project, presented as a written security report. Learners who want to go deeper into testing can move on to the 3-month Advanced Ethical Hacking & Penetration Testing Course. If you are still deciding where to begin, our list of cyber security certifications for beginners lays out the usual first steps.

Audit One Old Permission Today

Pick one system you manage, such as a cloud account, a shared drive or a wallet. List every person, app and partner that can still approve or sign anything there. Remove one access that no longer has a job to do. That small habit is the gap the Ronin attacker used. If you would like a guided way to build habits like this, our team is happy to answer questions about the course.