The Game Heist a Government Solved: How the FBI Tied Axie's $620 Million Loss to North Korea

Most video game crimes end with a banned account. This one ended with an FBI statement naming a foreign government.

On 23 March 2022, attackers drained the Ronin network, the blockchain built by Vietnamese studio Sky Mavis to run Axie Infinity. The haul was about $620 million in Ether and USDC. Weeks later, the FBI said its investigation had confirmed who did it: Lazarus Group and APT38, hacking groups that US authorities link to North Korea. The US Treasury sanctioned the crypto address involved. A game's security failure had become a national-security case.

What was taken

The theft came in two transactions: 173,600 Ether and 25.5 million USDC. It took Sky Mavis six days to notice. By value, it was the largest crypto breach on record as of May 2023.

The timing was brutal for Axie. The game had become a lifeline for many players in the Philippines during the pandemic, and its economy was already under strain. The hack caused a large drop in players.

Why the FBI got involved

Hacks of game companies are usually civil matters or local police cases. Ronin was different because of the scale and the suspects. The FBI said it had confirmed that the two North Korea-linked actors were responsible and that it would keep working with the Treasury Department and other partners to expose and counter North Korea's illicit revenue-generating activities, including cybercrime and cryptocurrency theft.

That framing matters. US authorities treat crypto theft by North Korean groups as a source of funding for the state, which brings in sanctions law. Once Treasury put the Ronin attacker's address on its sanctions list, any US person dealing with funds from it risked breaking US law. That makes stolen coins harder to cash out through regulated exchanges.

How Sky Mavis responded

Sky Mavis raised additional venture funding and reimbursed all affected users, a step few hacked crypto projects have taken. The company kept running Axie Infinity and the Ronin network. But the episode changed how the industry talks about bridges, the systems that move tokens between blockchains, which had become prime targets precisely because they hold large pools of assets.

The lesson for players and studios

The legal aftermath also showed how little a game company controls once funds leave its network. Recovery depended on law enforcement, exchanges and sanctions lists in other countries, not on anything Sky Mavis could do inside its own game.

For players, Ronin is a reminder that "owning" in-game assets on a blockchain does not protect them if the infrastructure around them fails. For studios, it showed that running your own chain means running a bank-sized security operation. And for regulators, it turned blockchain games into a sanctions and anti-money-laundering issue, not just a consumer one.

Why it matters

Korea's game regulator worries about gambling. The US government worried, in this case, about where the money went. Both concerns end up shaping how blockchain games are built, from who can hold the keys to a game's bridge to which exchanges will touch a token.

WGC's take: The Ronin hack is often told as a story about one company's mistake. It is also the moment governments learned that a blockchain game could hold enough money to interest a hostile state, and they have treated the sector differently ever since (how US regulators approached game NFTs).