khoji parkCrypto · Ronin Network · 2022
The Digital Bridge With a Very Expensive Hole
The convenient crossing had become a very attractive target.
Read in slides1. A bridge for a game economy
The Ronin network supported the cryptocurrency economy associated with Axie Infinity. A bridge allowed assets to move between systems. Such infrastructure can make activity convenient, but it also concentrates trust in the mechanisms that decide whether a transfer is authorised.
The convenient crossing had become a very attractive target.
2. Approval depended on validators
The bridge used a set of validator keys, with a threshold of approvals required for a transaction. Controlling enough of those keys could let an attacker authorise withdrawals. The design therefore depended on the security of the people and systems responsible for those credentials.
The bridge's locks were digital signatures, and enough locks could be stolen.
3. The keys are compromised
In March 2022, attackers obtained control sufficient to approve fraudulent withdrawals. The incident involved compromised access and approval mechanisms, rather than a mystical ability to create money. The crucial question was whether the system would accept the attacker's instructions as properly authorised.
The system saw enough signatures. It did not see legitimate permission.
4. Large withdrawals go through
The attackers withdrew substantial amounts of ether and USDC from the bridge. Reported dollar values varied with the valuation date, reaching hundreds of millions. The asset amounts and their changing market price should not be collapsed into a permanently exact headline figure.
The bridge had processed the transfers that it was supposed to prevent.
5. Discovery comes later
The theft was not publicly identified at the instant it happened. It came to attention after a user encountered difficulty withdrawing funds. That delay highlighted the importance of monitoring unusual activity, not merely checking whether the technical approval threshold had been satisfied.
The alarm did not ring when the money first crossed.
6. The bridge is suspended
Operators paused bridge activity while investigating and responding. That interruption affected legitimate users as well as the attackers' route. Containment required understanding which credentials and procedures had failed before rebuilding confidence in the system that handled other people's assets.
Closing the bridge stopped ordinary travellers too.
7. Authorities name an actor
US authorities attributed the theft to North Korea-linked Lazarus Group activity. That attribution belongs to the official findings and statements, rather than an independently witnessed scene inside an attacker's office. The investigation connected a gaming-related service with a much wider international cybercrime problem.
A game economy had become part of a geopolitical investigation.
8. Recovery has more than one meaning
Some assets were later traced or recovered through law-enforcement and industry work. Such successes did not mean every stolen unit instantly returned or every participant's experience was identical. Technical restoration, customer compensation and criminal recovery are related but distinct parts of an incident's aftermath.
Reopening a bridge and recovering its stolen cargo are different jobs.
9. The system is redesigned
The response included changes intended to improve validator security and oversight. Increasing participation, tightening access and monitoring transactions can reduce risks, but no diagram alone guarantees safety. The incident showed how a small set of compromised approvals could have consequences far larger than the apparent size of that set.
Decentralised language did not automatically remove concentrated trust.
10. The surprising weak point
The theft was dramatic because of its scale, but the mechanism concerned familiar problems: credentials, authorisation and delayed detection. The assets were novel; the security responsibilities were not. A bridge connecting digital worlds still needed dependable control over who could order money across it.
The futuristic crossing failed at a very old question: who gets the keys?