Incident reportBridge exploitEthereum / Ronin
Ronin Bridge −$625M
Nobody noticed for six days.
What happened
The bridge behind the game Axie Infinity needed five of nine validator keys to move funds. Attackers got five, and walked out with 173,600 ETH and 25.5 million USDC.
Timeline
Mar 23
Two withdrawals drain the bridge.
Mar 29
Six days later, a user can't withdraw and the theft is discovered.
Apr 14
The FBI names the Lazarus Group.
Aftermath
Sky Mavis raised money to repay users and reopened the bridge with more validators.
Date2022-03-23
Lost$625M
WhoAttributed by the FBI to North Korea's Lazarus Group
Decentralised. Ish.
Lesson Five of nine sounds like a lot until four of them belong to the same company.