The $625 Million PDF: How One Fake Job Offer Emptied Axie's Ronin Bridge

On the morning of 29 March 2022, a user of the Ronin network tried to withdraw 5,000 ETH from its bridge to Ethereum. It didn't work. When the team behind Ronin looked into why, they found that the bridge had already been emptied. The theft had happened six days earlier, on 23 March, and nobody had noticed.

In two transactions, attackers had taken 173,600 ETH, worth about $597 million, and 25.5 million USDC, a dollar-pegged stablecoin. The total, close to $625 million at the time, made it the largest theft in decentralised finance up to that point. It was also, by a long way, the largest heist ever connected to a video game.

What Ronin was, and why it held so much money

Ronin was a sidechain: a separate blockchain linked to Ethereum, built by Vietnamese studio Sky Mavis specifically for its hit game Axie Infinity. In 2021 Ethereum fees were so high that trading a cheap creature could cost more than the creature itself. Ronin solved that by moving the action onto its own chain, where transactions were fast and nearly free.

To get money in and out, players used a bridge: a smart contract that locked funds on Ethereum and released matching funds on Ronin, and vice versa. At the height of the Axie boom, when the game had about 2.7 million daily players, that bridge became one of the biggest piles of crypto anywhere.

The weak point: five keys

Ronin used a system called proof of authority. Instead of thousands of independent computers agreeing on each transaction, it relied on nine validators, trusted parties each holding a private key. Any withdrawal from the bridge needed signatures from five of the nine.

That design is fast and cheap. It is also only as safe as the five keys. And as it turned out, Sky Mavis itself controlled four of them.

The fake recruiter

How did the attackers get the keys? Sky Mavis first said only that an employee had been compromised by spear-phishing, a targeted scam. The full story came out in July 2022, when The Block reported the details.

Attackers posing as recruiters for a company that didn't exist approached Sky Mavis staff on LinkedIn. A senior engineer went through several rounds of interviews and was then offered a job. The offer arrived as a PDF. Opening it installed spyware that gave the attackers a way into Ronin's systems.

From there they took control of the four validator keys run by Sky Mavis. That left them one key short.

The permission nobody switched off

The fifth key came from a shortcut taken months earlier. In November 2021, with Axie traffic overwhelming the network, the Axie DAO (the community body that runs one of the validators) had allowlisted Sky Mavis to sign transactions on its behalf, to help handle the load. That arrangement ended in December 2021. But the permission was never revoked.

So when the attackers controlled Sky Mavis's systems, they could also sign as the Axie DAO validator. Four plus one made five. The bridge treated their forged withdrawals as legitimate.

By the numbers

• 173,600 ETH and 25.5 million USDC: what was taken, in two transactions.
• About $625 million: the total at the time of discovery.
• 6 days: the gap between the theft (23 March) and its discovery (29 March).
• 9 validators, 5 needed: the security threshold the attackers beat.
• $150 million: the Binance-led funding round Sky Mavis raised in April 2022 to help repay users.
• 11: validators on Ronin a month after the hack, with a long-term goal of more than 100.

Who did it

On 14 April 2022, the FBI attributed the hack to the Lazarus Group and APT38, hacking groups linked to the North Korean state. Some of the stolen funds were later run through Tornado Cash, a service that mixes crypto transactions to hide their trail. Security researchers had already documented Lazarus using fake recruiters on LinkedIn against aerospace and defence companies, though they did not directly tie that campaign to Ronin.

On 8 April 2022, Sky Mavis warned that recovering any of the stolen funds could take years.

Paying people back

What happened next is the part of the story that is often forgotten. Rather than leave players to absorb the loss, Sky Mavis moved to repay them. In April 2022 it raised $150 million in a round led by the exchange Binance, and combined that with its own funds to reimburse users. Repayments were scheduled to start on 28 June 2022, and the Ethereum bridge relaunched at about the same time. Tokens held on Ronin itself, including AXS, RON and SLP, had not been touched.

Sky Mavis also rebuilt its security: more validators, new internal controls, and a post-mortem published on 27 April 2022. The employee who had opened the file no longer worked at the company.

The damage to trust was harder to repair. The hack came just as Axie's economy was already collapsing, which we explain in our piece on the SLP crash. Players and NFT prices kept falling after the bridge reopened.

The second scare, two years later

On 6 August 2024, Ronin's bridge was hit again, this time for about $12 million: just under 4,000 ETH and 2 million USDC. The cause was an upgrade mistake. When the bridge contract was updated, one setup step was skipped, leaving a key value at zero and effectively switching off the check that counted validator votes.

This time the money came back. The first to spot the flaw was an automated MEV bot, a program that scans the blockchain for profitable transactions, operated by "white hat" actors who returned the funds. Ronin paused the bridge within about 40 minutes of the first suspicious activity and offered a $500,000 bounty. A withdrawal limit protected another $72 million, and the team said more than $850 million held by the bridge was safe.

WGC's take

It is tempting to read the Ronin hack as a story about blockchains being unsafe. The more uncomfortable reading is that the blockchain worked exactly as designed. The code checked for five valid signatures, and it got five. What failed were people and processes: a phishing attack that any company could fall for, a temporary permission left switched on, and monitoring so thin that a $625 million hole went unseen for almost a week.

That matters for games. A bridge or wallet that holds player assets is, in effect, a bank vault, and it needs to be treated like one. Sky Mavis deserves credit for repaying users rather than leaving them to absorb the loss. But the episode also showed how much risk players were taking on without knowing it, simply by playing a game about cute monsters.

What to watch

Bridges remain one of the most attacked pieces of crypto infrastructure, and gaming chains are no exception, as the 2024 exploits at Munchables and elsewhere showed. When a blockchain game asks you to move assets across a bridge, it is worth asking who holds the keys, how many signatures are needed, and how quickly anyone would notice if something went wrong. For the full Axie story, start with how the game became a phenomenon.