What happened
Ronin's bridge had 9 validators and needed 5 signatures to approve a withdrawal. The attacker controlled 4 validators run by Sky Mavis plus 1 Axie DAO validator, reached through an access permission from late 2021 that was never revoked (project's own account).
The validators were compromised on March 23, 2022; the theft was found only on March 29 when a user could not withdraw. The project raised its threshold to 8 of 9.
On April 14, 2022 the FBI said North Korea’s Lazarus Group was responsible for the theft of US$620 million in Ethereum reported on March 29.
Scale, from official records
- US$620 million in Ethereum (FBI, 2022-04-14)
- 173,600 ETH and 25.5 million USDC (Ronin’s own figure, 2022-03-29)
The Canadian angle
Global reference case; no Canadian-specific angle sourced. Included because bridge custody concentration is the core DeFi risk it illustrates.
What broke
A small validator set where one company controlled most keys, stale access permissions, and no monitoring for six days.
What a user could have checked
- How many independent signers secure a bridge and what threshold is needed.
- Whether one company controls enough keys to meet that threshold.
- Whether the bridge has monitoring, rate limits and pause controls.
Recovery
No recovery figure confirmed on an official page.
Sources
- FBI statement on attribution of malicious cyber activity posed by the DPRK — FBI, 2022-04-14
Supports: Lazarus attribution; $620M · checked 2026-11-01 - Community alert: Ronin validators compromised — Ronin / Sky Mavis (archived), 2022-03-29
Supports: 5-of-9 scheme, allowlist, 173,600 ETH + 25.5M USDC (project figures) · checked 2026-11-01