Ronin Bridge: North Korea's $625M Payday

On 29 March 2022 a player of Axie Infinity tried to move 5,000 ether out of the game's network and the transfer failed. There was nothing to send it from. Six days earlier, on 23 March, hackers had emptied the bridge that held the game's money: 173,600 ether and 25.5 million USDC, a dollar-backed stablecoin (a digital dollar), worth about $625 million at the time. Nobody at the company had noticed.

The FBI later named the thieves: the Lazarus Group, a hacking unit of the North Korean state. It was the largest crypto theft on record at that point, and the money went to a government under United Nations sanctions for its nuclear weapons programme.

The game and the bridge

Axie Infinity, made by the Vietnamese studio Sky Mavis, was a game in which players bred and battled cartoon creatures called Axies, each one a token that could be bought and sold. At its peak in late 2021 it had millions of daily players, many of them in the Philippines, where some families earned more from the game than from local jobs. This was "play-to-earn": in-game rewards that could be cashed out for real money.

To keep fees low, Sky Mavis ran the game on its own blockchain, Ronin, a sidechain (a smaller network that runs alongside Ethereum, much as a company might run its own internal ledger beside the bank's). Money moved between Ronin and Ethereum through the Ronin Bridge, which held the real coins on the Ethereum side and issued matching coins inside the game. By March 2022 the bridge held well over half a billion dollars.

Withdrawals from the bridge needed approval from validators, computers whose digital signatures the bridge trusted. There were nine of them, and any five could approve a payment, like a company account that needs five of nine directors to sign. The trouble was who held the pens. Sky Mavis ran four of the nine itself.

A fake job and a forgotten permission

In November 2021, when the game was so busy that users struggled to pay transaction fees, a separate validator run by the Axie DAO (a community group of Axie token holders) let Sky Mavis sign on its behalf to help offer free transactions. The arrangement ended in December 2021. The permission was never switched off.

That meant whoever controlled Sky Mavis's systems controlled five signatures, not four. Lazarus went after the company's staff. According to a July 2022 report by The Block, citing two people with direct knowledge, a senior Sky Mavis engineer was approached on LinkedIn by a company that did not exist, interviewed over several rounds and offered a generous package. The offer letter arrived as a PDF. Opening it installed spyware. Sky Mavis's own post-mortem described "advanced spear phishing", targeted fake messages, and said one employee had been compromised.

From that foothold, the hackers took the keys to Sky Mavis's four validators and used the old permission to get the Axie DAO's signature as well. Five out of nine. On 23 March they signed two withdrawals and the bridge paid out. Sky Mavis had nothing in place that flagged a withdrawal that size, so for six days nobody knew.

Where the money went

The FBI attributed the theft to Lazarus on 14 April 2022, and the US Treasury's sanctions office added the attacker's address to its blacklist. The hackers swapped the USDC for ether, since stablecoin issuers can freeze their tokens and ether cannot be frozen, and then pushed the coins through mixers. A mixer pools coins from many users and pays out different ones, like a laundromat for money trails. Treasury sanctioned the mixer Blender in May 2022 and Tornado Cash in August 2022, saying both had laundered Ronin proceeds. It sanctioned Sinbad, which analysts treated as Blender relaunched, in November 2023, again naming the Axie theft. The Tornado Cash sanctions were lifted in March 2025 after a US appeals court ruled against them.

Very little came back. In September 2022 the analytics firm Chainalysis said more than $30 million had been seized with law enforcement's help. In February 2023 Norway's economic crime unit, Økokrim, seized 60 million kroner, about $5.8 million, which it called Norway's largest crypto seizure. Analysts and governments including the US have said such thefts help pay for North Korea's missile and weapons programmes.

Who paid, and what happened to Ronin

The players did not lose their money. On 6 April 2022 Sky Mavis raised $150 million in a round led by Binance, and it used that and its own balance sheet to back every user's deposits one for one. The bridge reopened on 28 June 2022 with all the compromised validators replaced. The number of validators grew, to 17 by August 2022, and Sky Mavis promised stricter controls on its own share.

The game did not get its crowd back. Axie's token prices and player numbers had already started falling before the hack and kept falling after it, and play-to-earn as a business model largely collapsed. Ronin's bridge had another scare on 6 August 2024, when a faulty upgrade let about $12 million out. That time white-hat hackers (people who break in to help) and automated trading bots got there first, returned the money within hours and were paid a $500,000 reward. Ronin later moved its bridge to Chainlink's cross-chain system, and on 12 May 2026 the network stopped being an independent sidechain altogether and became a layer 2, a network that settles its transactions on Ethereum and borrows its security. Four years after nine keys failed it, Ronin gave up running its own.