how it happened
- whoLazarus Groupper the FBI and OFAC
- the gapfour Sky Mavis keysplus a permission never revoked
- thenthe Ronin bridgefive of nine signatures needed
- the result173,600 ETH and 25.5M USDCnoticed six days later
what everyone assumed
The Ronin bridge, which held the funds behind the game Axie Infinity, was protected by a rule that sounds strong: any withdrawal needed signatures from five of nine validators. One compromised company or one stolen key could not move anything. The designers counted who held the keys and concluded no single party could reach five.
what happened
According to the postmortem Ronin published on 27 April 2022, in November 2021 the Axie DAO, which ran one of the validators, allowlisted Sky Mavis, the company behind Axie Infinity, to sign transactions on its behalf. It was a temporary measure to cope with heavy user load. The arrangement was discontinued in December 2021, and the postmortem says the allowlist access was not revoked.
On 23 March 2022 an attacker used four validator keys controlled by Sky Mavis, plus the old permission to obtain a signature for the Axie DAO’s validator, and so reached five of nine. Two withdrawals took 173,600 ETH and 25.5 million USDC, worth more than $540 million at the time. Sky Mavis said the way in was spear-phishing that compromised one employee. The Block reported on 6 July 2022, citing two anonymous sources, that a senior engineer had been approached with a job at a company that did not exist and had opened the offer as a PDF. Sky Mavis declined to comment on that account.
On 14 April 2022 the US Treasury added the attacker’s Ethereum address to its sanctions entry for the Lazarus Group, and the FBI attributed the theft to North Korean hackers.
step by step
- withdrawals from the bridge need five of nine validator signaturesSky Mavis runs four of the validators, and the Axie DAO runs one.
- November 2021the Axie DAO lets Sky Mavis sign on its behalfA temporary arrangement to handle heavy user load, per the postmortem.
- December 2021the arrangement ends and the permission staysIn the postmortem's words, the allowlist access was not revoked.the assumption breaks here
- 23 March 2022four stolen keys plus the old permission make fiveTwo withdrawals empty the bridge; a user who cannot withdraw raises the alarm on 29 March.
how it surfaced
Nobody inside noticed for six days. Ronin said the theft was discovered on 29 March, when a user reported being unable to withdraw 5,000 ETH from the bridge, and the postmortem acknowledges there was no monitoring of large outflows. Sky Mavis raised the signature threshold to eight of nine, added validators, and reopened the bridge in June 2022 after a funding round led by Binance that it used to reimburse users.
A permission you stop using keeps working until someone removes it.
The five-of-nine rule was sound on the day it was designed. The temporary permission changed the arithmetic from that day on, and nobody went back to recount.
picture it at a company like yours
The company here is made up. The other two paths are not: they happened, and each links to the story.
- in this storythe day it mattersThe busy quarter ends and nobody switches the delegation off.what it costs youOne stolen login at the assistant's desk now carries both approvals.
- or it goes like thisit happenedCash App / Block, 2022howThe person logs back in from home, weeks after leaving.what leavescustomer lists and reportswho ends up with itthe former employee and whoever they work for next
- or it goes like thisit happenedColonial Pipeline, 2021howThe forgotten account's password turns up in a breach dump.what leavesa working way into the networkwho ends up with ita ransomware crew
sources
- Ronin Network: Community alert, Ronin validators compromised (29 March 2022, archived)
- Ronin Network: Back to building, Ronin security breach postmortem (27 April 2022, archived)
- US Treasury OFAC: North Korea designation update (14 April 2022)
- BleepingComputer: FBI links largest crypto hack ever to North Korean hackers
- The Block: How a fake job offer took down the world's most popular crypto game (6 July 2022)
your turn
what you can do about it
this week
List every "on behalf of" permission in your company and ask whether it is still needed.
Look at mailbox delegations, approval delegations in your finance tool, shared admin roles and "act as" rights in your main business apps. Most were granted for a holiday, a busy month or a migration. Remove the ones whose reason has passed, because Ronin's fifth signature came from a favour that ended three months earlier.
go deeper
if you're not sure where to start
Run the offboarding checklist on one leaver. It covers every account and token to close when someone leaves.
open the checklist →