Ronin bridge theft via compromised validator keys

On March 23, 2022 attackers used private keys for five of the Ronin bridge's nine validators to sign withdrawals worth almost $620 million; the theft was found on March 29, 2022. Four keys came from Sky Mavis infrastructure, reportedly reached through a spyware-laden fake job offer sent to an engineer, and the fifth came from an Axie DAO validator allowlist granted to Sky Mavis in late 2021 that was never revoked. The FBI attributed the attack to North Korea's Lazarus Group.

Victim

Sky Mavis (Ronin Network, Axie Infinity)

Industry

Crypto and Web3

Country

Vietnam

Intrusion began

Mar 23, 2022

First disclosed

Mar 29, 2022

Actor

Lazarus Group (Nation-state)

Initial access

Stolen credentials

Identity control that failed

Non-human identity

MFA

Not applicable (no interactive login)

Abused identity

Non-human (service account, token, key or app)

Records affected

Not disclosed

Disclosed cost

$620 million (Value stolen, described by the U.S. Treasury as almost $620 million (173,600 ETH and 25.5 million USDC).)