Ronin bridge validators were taken over

The bridge reopened on June 28, and users' ETH and USDC were to be made up at the price then

Reimbursement · Aleksander Larsen

CoinDesk reported that Sky Mavis would compensate users from June 28, and that the bridge would also restart that day. Because the price of ether had fallen, the report, at that day's prices, wrote the USDC and ether to be returned as $216.5 million. Co-founder Aleksander Larsen told CoinDesk that the bridge would be refilled with the ETH and USDC that belonged to users and had not yet been returned.

The bridge will be refilled with the outstanding user-owned ETH and USDC.

• CoinDesk · Article · Secondary

While sanctioning a mixer, the Treasury wrote that Lazarus carried out this theft

Enforcement · U.S. Treasury

On May 6, in a press release sanctioning the mixer Blender.io, the Treasury wrote that on March 23 Lazarus Group stole nearly $620 million from a blockchain project linked to Axie Infinity. Blender processed more than $20.5 million of it. The same release said the list update of April 14 was this attribution.

On March 23, 2022, Lazarus Group, a DPRK state-sponsored cyber hacking group, carried out the largest virtual currency heist to date, worth almost $620 million, from a blockchain project linked to the online game Axie Infinity.

• U.S. Treasury · Statement · Primary
• U.S. Treasury OFAC · Statement · Primary

The address tied to the stolen funds was added to the Lazarus Group sanctions list

Enforcement · U.S. Treasury OFAC

On April 14 the Treasury updated the SDN list and added Ethereum address 0x098B716B8Aaf21512996dC57EB0615e2383E2f96 to Lazarus Group. This is the public record that links this address to Lazarus.

• U.S. Treasury OFAC · Statement · Primary

$150 million was raised to make up user funds

Reimbursement · Sky Mavis

Sky Mavis wrote on its blog that this round was led by Binance. Together with the company's own funds, it was used to make sure users affected by the Ronin validator incident were compensated. The article wrote the root cause as a validator set that was too small, and said the company takes full responsibility for this incident. The bridge would open only after a security upgrade and an audit.

We take full responsibility for the breach.

• Sky Mavis · Statement · Primary

The Sky Mavis validators that had been taken over were replaced

Industry · Ronin

The Block quoted the development team in the community alert. That day all of the former Sky Mavis validators were replaced, and there were plans to add validators. The bridge itself had not reopened yet.

Today we replaced all of the former Sky Mavis validators.

• The Block · Article · Secondary

Six days later it was found because 5,000 ETH could not be withdrawn

Alert · Ronin · @Ronin_Network

The project said discovery came from a report that a user could not withdraw 5,000 ETH from the bridge. The same day they announced a security incident on Ronin. On the day of disclosure, Decrypt wrote 173,600 WETH and 25.5 million USDC together as about $622 million.

We discovered the attack this morning after a report from a user being unable to withdraw 5k ETH from the bridge.

• Ronin · Statement · Primary
• Decrypt · Article · Secondary

Four Sky Mavis validators plus one Axie DAO vote were used to forge withdrawals

Technical · Sky Mavis

Ronin's community alert said that on March 23 the Sky Mavis validator nodes and the Axie DAO validator node were taken over. Two transactions moved 173,600 ether and 25.5 million USDC off the bridge. At the time, five votes out of nine validators were required to recognize a withdrawal. The attacker obtained four Sky Mavis validators, and one third-party validator run by Axie DAO.

The attacker used hacked private keys in order to forge fake withdrawals.

• Ronin · Statement · Primary