Ronin Network bridge hack
From Invertopedia, the encyclopedia of how things fail
Ronin is the Ethereum sidechain that Sky Mavis built for the game Axie Infinity[1]. On March 23, 2022, an attacker used keys for five of its nine validators, four run by Sky Mavis and one by the Axie DAO, to sign two withdrawals that drained 173,600 ETH and 25.5 million USDC from its bridge[4][5][2], about $625 million at the time[3]. Nobody noticed for six days, until a user could not withdraw 5,000 ETH[4][5]. The FBI blamed North Korea's Lazarus Group[1].
Contents
The bet
Ronin used a "proof of authority" system: nine trusted validators signed transactions, and five of them had to approve a withdrawal from the bridge[5][7]. Sky Mavis said its validator key scheme was "set up to be decentralized" to limit exactly this kind of attack[4]. Sky Mavis itself ran four of the nine, one short of the five needed[4].
In November 2021, under heavy user load, Sky Mavis asked the Axie DAO for help, and the DAO let Sky Mavis sign transactions on its behalf[4][2]. The arrangement ended in December 2021. The access was never revoked[4][2].
What happened
| Nov 2021 | Under heavy load, the Axie DAO allowlists Sky Mavis to sign transactions on its behalf.[4][2] |
|---|---|
| Dec 2021 | The arrangement ends, but the allowlist access is not revoked.[4][2] |
| Before the hack | A senior Axie Infinity engineer applies for a job at a company that does not exist. The offer arrives as a PDF that carries spyware, and the attackers take over four of the nine validators.[7] |
| Mar 23, 2022 | Using the old allowlist to get the Axie DAO validator's signature as the fifth, the attacker signs two withdrawals and drains 173,600 ETH and 25.5 million USDC.[4][5][2] |
| Mar 29, 2022 | A user cannot withdraw 5,000 ETH. Sky Mavis finds the hack, discloses it and pauses the bridge.[1][4][8] |
| Apr 2022 | Sky Mavis raises $150 million in a round led by Binance to aid the recovery.[9] |
| Apr 14, 2022 | The FBI attributes the theft to Lazarus Group and APT38, and the Treasury's OFAC sanctions the address that received the funds.[1][3] |
| Late Apr 2022 | Sky Mavis's postmortem traces the breach to a phished employee and admits its monitoring of large bridge outflows was weak.[2] |
| Jun 2022 | After a Certik audit, Sky Mavis plans to reopen the bridge on June 28 with all user funds returned.[9] |
| Sep 2022 to Feb 2023 | The FBI and Chainalysis seize $30 million of the stolen crypto; with a later Norwegian seizure, nearly $40 million is recovered.[6] |
The kill shot
A bridge holding over $600 million was guarded by nine keys, but one company could reach five of them, and nothing was watching the money leave.
Sky Mavis said a phishing attack on one employee gave the attacker its infrastructure and its validators[2]. The Block reported that the lure was a fake job offer delivered as a PDF[7]. That gave the attacker four signatures, one short[7]. The fifth came through a gas-free RPC node, where the old allowlist still let Sky Mavis systems obtain the Axie DAO validator's signature[4].
Then nothing happened for six days. Sky Mavis had no monitoring that could catch $624 million leaving the bridge, and found out only when a user reported that it lacked funds[5]. The team itself said it missed the attack because its system for watching large outflows from the bridge address was weak[2].
Red flags ignored
- Four of nine keys in one company. With five needed, one more signature turned a decentralized-looking set into one company's control.[4][5]
- A temporary permission left on. The Axie DAO's signing allowlist outlived the arrangement it was made for by about three months.[4][2]
- No alarm on the vault. Large outflows from the bridge address did not trigger anything.[5][2]
- Staff as the attack surface. One downloaded PDF reached the validator infrastructure.[7]
The cost
The attacker took 173,600 ether, about $597 million, and $25.5 million in USDC, $625 million in all at the time, the largest decentralized finance hack to that date[3]. By April 14, Elliptic estimated that 14 percent of it had already been laundered[3].
Sky Mavis raised $150 million in a round led by Binance, with Animoca Brands, Andreessen Horowitz and Paradigm, to aid the recovery[9]. Law enforcement had recovered nearly $40 million by February 2023[6].
The inversion
Count how many keys a single company or a single breach can reach, not how many keys exist; revoke every temporary permission the day it ends; and put an alarm on any large outflow from the vault.
What survived
The bridge and the chain. A month after the hack Sky Mavis had increased its validator nodes to 11, with a long-term goal of more than 100[7]. The redesigned bridge passed a Certik audit and was set to reopen on June 28, 2022 with user funds returned, alongside a $1 million bug bounty[9]. What the hack did to the game's economy is in the Axie Infinity entry.
References
- ^ “FBI links largest crypto hack ever to North Korean hackers”. BleepingComputer, April 14, 2022. The FBI's attribution to Lazarus Group and APT38, the OFAC sanction, the March 29 disclosure, the amounts, and what Ronin is.
- ^ “Ronin sidechain developers reveal further details of $625 million hack”. ForkLog, April 28, 2022. The March 23 date and the postmortem: a phished employee, the November 2021 Axie DAO arrangement, weak outflow monitoring, and the plan for 21 validators.
- ^ “US officials link North Korean Lazarus hackers to $625M Axie Infinity crypto theft”. TechCrunch, April 14, 2022. The OFAC sanction, the $597 million in ether plus $25.5 million USDC, $625 million at the time, largest DeFi hack to date, and Elliptic's 14 percent laundered estimate.
- ^ “Hacker Drains $622M From Axie Infinity's Ronin Ethereum Sidechain”. Decrypt, March 29, 2022. The March 23 date, five of nine validators (four Sky Mavis, one Axie DAO), the gas-free RPC node backdoor, the November 2021 allowlist never revoked, and discovery through a failed 5,000 ETH withdrawal.
- ^ “Explained: The Ronin Hack (March 2022)”. Halborn, March 30, 2022. Five of nine approvals needed, two withdrawals, the six-day detection gap, and no monitoring.
- ^ “Norwegian Authorities Seize $5.86 Million From Lazarus Group”. BankInfoSecurity, February 20, 2023. The $30 million FBI and Chainalysis seizure in September 2022 and nearly $40 million recovered in all.
- ^ “How a fake job offer took down the world's most popular crypto game”. The Block, July 6, 2022 (Internet Archive copy). The fake job offer and PDF spyware, four of nine validators taken, proof of authority with nine trusted actors, 11 validators a month later.
- ^ “US blames North Korean hacker group Lazarus for $625 mn crypto heist”. IANS via Business Standard, April 15, 2022. Ronin's statement on forged withdrawals and the user report, and the paused bridge.
- ^ “Axie Infinity's Ronin Bridge to Re-Open After $552M Hack”. Decrypt, June 2022. The June 28 reopening with user funds returned, the Certik audit, the $150 million Binance-led round, and the $1 million bug bounty.