Ronin Bridge Hack — A Blockchain Forensic Walkthrough of the $625M Lazarus Theft

Why This Case Still Matters in 2026

Ronin is four years old now. A lot has shifted since: Bybit eclipsed it as the largest financial heist ever, OFAC's sanction list has expanded, bridge security matured into its own discipline. But Ronin is still the foundational case I point people at when they're learning blockchain forensics. Three reasons.

First, it was the first DeFi exploit unambiguously attributed to a nation-state actor at the federal-sanctions level. Lazarus had been linked to crypto theft before. Ronin was the case where OFAC put the SDN-list weight behind the attribution. That changed the legal posture of every later investigation.

Second, it produced the first OFAC sanction of a smart contract. Tornado Cash hitting the SDN list in August 2022 reshaped the regulatory posture of crypto privacy infrastructure. The Ronin laundering was the cited justification.

Third, the case is a complete worked example of every category of failure that bridges and exchanges still get wrong. Insufficient validator independence. Stale allowlist permissions that never got revoked. No continuous withdrawal monitoring. Social engineering targeting senior engineers. Slow incident response. The post-Ronin remediation playbook is now standard practice. The pre-Ronin pattern still shows up in newer protocols, which is why investigators keep working similar cases at smaller scale.

For a working forensic investigator, Ronin is the case you study to learn how Lazarus actually operates. Every Lazarus operation since, including the $1.46B Bybit hack of February 2025, reuses elements of what Ronin taught us about DPRK-affiliated tradecraft.

By the Numbers

• Date of attack: March 23, 2022
• Date of discovery: March 29, 2022 (6-day gap)
• Total stolen: 173,600 ETH + 25.5 million USDC ($540M at the time of theft, ~$625M at later valuations)
• Attack vector: Social engineering via fake job offer PDF + abuse of Axie DAO allowlist
• Validators compromised: 5 of 9 (the threshold for authorizing transfers)
• Attribution: OFAC sanctions on April 14, 2022 named Lazarus Group as the responsible actor
• Primary attacker wallet: 0x098B716B8Aaf21512996dC57EB0615e2383E2f96
• Laundered through Tornado Cash: Over $80 million by August 2022
• Tornado Cash sanctioned: August 8, 2022 (first OFAC sanction of a smart contract)
• Reimbursement raised: $150M led by Binance, with participation from Animoca Brands, a16z, and others
• Bridge relaunched: Late June 2022 with hardened security

The Attack: Validator Compromise via Fake Job Offer

The attack vector that took down Ronin is one of the most studied in blockchain security history because it's both technically sophisticated and operationally simple. The technical sophistication: state-sponsored spyware, persistent access, multi-step privilege escalation. The operational simplicity: a senior engineer opened a Word document.

The spear-phishing

Per reporting by The Block and Sky Mavis's official postmortem, the entry point was a fake job offer sent to a senior engineer at Sky Mavis. The offer was targeted, plausible, and well-researched — everything you'd expect from a state-sponsored social-engineering operation. The engineer engaged with what he believed was a real recruiter; through the course of the conversation, he was sent a job-offer document as a Word/PDF file. Opening the document triggered the spyware payload.

From there, the attackers had persistent access to a senior engineer's workstation. That access let them pivot through Sky Mavis's internal systems and ultimately compromise the cryptographic keys for four of the nine Ronin validator nodes. Each validator has a key that can sign cross-bridge transfers; obtaining four was three short of the five-of-nine threshold required to authorize a transfer. The attackers needed one more.

The Axie DAO allowlist

Here's where the case gets infuriating. In November 2021, some months before the attack, Sky Mavis had asked the Axie DAO (which controlled one of the nine validators) for help handling an unusually large user load. The Axie DAO granted Sky Mavis allowlist authority to sign transactions on the DAO's behalf via a gas-free RPC node. The arrangement worked, the user-load issue resolved by December 2021, and the allowlist was no longer needed.

The allowlist was never revoked. Months later, when Lazarus had compromised four validator keys via the spear-phishing attack, the attackers discovered that the gas-free RPC node still allowed Sky Mavis to sign as the Axie DAO validator. They abused that endpoint to obtain the fifth required signature without needing to compromise the Axie DAO's actual key.

Five of nine. Threshold met. Transfer authorized.

The drain

With five validator signatures in hand, the attackers initiated cross-bridge withdrawal transactions and routed the funds to 0x098B716B8Aaf21512996dC57EB0615e2383E2f96, a fresh wallet they controlled. The drain happened in two batches:

• 173,600 ETH moved out of the bridge to the attacker wallet
• 25.5 million USDC moved separately

Total at-the-time value: $540 million. At later valuations (when ETH price had climbed), the figure is more commonly cited as $625 million.

The 6-Day Detection Gap

The attack happened on March 23, 2022. Sky Mavis didn't discover it until March 29, 2022, almost a week later. And the discovery wasn't internal. It came from a user complaining they couldn't withdraw 5,000 ETH from the bridge.

Six days is an eternity in crypto incident response. It gave the attackers a full week to:

• Consolidate funds into staging wallets without time pressure
• Start initial laundering hops through Tornado Cash
• Move portions to additional wallets to fragment future trace work
• Set up the laundering pipeline that would keep running for months

This is the single most-studied lesson of the Ronin case. Bridges holding nine-figure sums need continuous, automated monitoring of withdrawal patterns. Alerts on any transfer above a threshold. Alerts on any deviation from historical patterns. Alerts on any drain above a small fraction of total reserves. Sky Mavis's bridge had none of that at the time. Post-Ronin, automated bridge monitoring became standard practice across DeFi.

This gap is also why the Bybit hack three years later played out so differently. ZachXBT publicly attributed the theft and mapped 920+ laundering addresses within 24 hours of the Bybit drain. That forensic-response capability didn't exist in 2022. Ronin is one of the cases that forced its development.

OFAC's Lazarus Attribution

For roughly three weeks after the discovery, public reporting on the Ronin hack carried the usual qualifications: "the attackers are believed to be sophisticated," "private analysis suggests state-sponsored involvement," and so on. Then on April 14, 2022, OFAC made it official.

The U.S. Treasury added 0x098B716B8Aaf21512996dC57EB0615e2383E2f96 to the Specially Designated Nationals (SDN) list, attributing the address to Lazarus Group — the North Korean state hacking unit operating under the DPRK's Reconnaissance General Bureau. Elliptic's analysis at the time matched the attribution against prior Lazarus-linked patterns, and the FBI later issued joint advisories with CISA on DPRK-affiliated actors targeting blockchain infrastructure.

The attribution of the Ronin hack to Lazarus Group underlines two industry needs Chainalysis has highlighted before: Understanding of how DPRK-affiliated threat actors exploit crypto, and better security for DeFi protocols.

— Chainalysis (@chainalysis) April 14, 2022

What the OFAC designation actually does, mechanically:

• Every U.S.-touching financial institution and crypto exchange must screen against the SDN list
• Funds traceable to the sanctioned address must be frozen if they reach a U.S.-cooperative venue
• U.S. persons are prohibited from transacting with the address
• The legal basis for civil and criminal asset forfeiture is established

Treasury later added more North Korea-linked Ethereum wallets to the SDN list as the laundering progressed, expanding the freeze obligation across a wider attribution network. This was the first major instance of OFAC using sanction designations to disrupt crypto laundering at scale — the precedent that all later DPRK-related sanctions, including the Tornado Cash designation, would build on.

The Laundering: Tornado Cash and the First Smart-Contract Sanction

The Lazarus laundering pattern that has since become familiar — fragment, swap, bridge, mix, off-ramp — was running at full operational scale in the Ronin aftermath, just on a slower timeline than later operations. The key venues:

Initial fragmentation

The 173,600 ETH was first split across multiple secondary wallets to break the obvious link to the primary attacker address. Per Chainalysis and Elliptic analyses at the time, this fragmentation pattern was already familiar from prior Lazarus operations — one of the behavioral signatures that confirmed the attribution.

Tornado Cash mixing

The dominant laundering venue was Tornado Cash, the Ethereum mixing protocol. Lazarus deposited large quantities of ETH into Tornado Cash pools and withdrew via fresh addresses, attempting to break the on-chain trace at the mixer boundary. By August 2022, Chainalysis estimated more than $80 million worth of Ronin funds had been laundered through Tornado Cash — with additional flows continuing in later months.

The trace through Tornado Cash isn't impossible — timing analysis, denomination correlation, and post-withdrawal behavioral patterns can identify likely demix pairings — but it is probabilistic rather than deterministic. Some portion of the Ronin funds entered Tornado Cash and effectively disappeared into the legal definition of "untraceable," even though the on-chain record remained.

The first smart-contract sanction

On August 8, 2022, the U.S. Treasury did something that had never been done before: it sanctioned a smart contract. Tornado Cash itself was added to the SDN list, with 38 specific Ethereum addresses listed as the sanctioned entities. Treasury's press release explicitly cited Tornado Cash's role in laundering "more than $455 million worth of cryptocurrency stolen by the Lazarus Group" — the bulk of which was the Ronin proceeds.

The Tornado Cash sanction was massively controversial in the crypto industry. It established that smart contracts could be designated as sanctioned entities, that interacting with them could violate sanctions, and that the OFAC framework would apply to decentralized protocols in addition to centralized platforms. The DOJ later indicted Tornado Cash developers Roman Storm and Roman Semenov, and Alexey Pertsev was convicted in the Netherlands in 2024 on related charges.

Whatever you think of the Tornado Cash sanction as policy, the precedent is now baked in. And Ronin is the case that established it.

Recovery and Reimbursement

One thing the Ronin case got right that many later hacks didn't: Sky Mavis fully reimbursed affected users.

In April 2022, less than a month after the discovery, Sky Mavis raised $150 million specifically to fund victim reimbursement. The capital raise was led by Binance with participation from Animoca Brands, a16z, Paradigm, and others. The ETH and USDC drained from the bridge was reimbursed back to the user pools, allowing the bridge to be relaunched with the original deposits intact rather than partially impaired.

The bridge itself was relaunched in late June 2022 with hardened security:

• Expanded validator set — the number of validators grew, with broader independence among the operating parties
• Mandatory hardware-wallet signing for validator keys, eliminating the spyware-on-engineer-workstation attack vector
• Continuous bridge monitoring with alerting on unusual withdrawal patterns
• Allowlist auditing — periodic reviews of any cross-organization signing permissions, with automatic expiration if not affirmatively renewed

Recovery of the actual stolen funds, separately from reimbursement, has been more partial. Some portion was frozen at exchanges that picked up the OFAC sanctions and screened against the SDN list. Some was eventually clawed back through international cooperation. A meaningful share was successfully laundered through Tornado Cash and offshore venues to endpoints from which legal recovery is impractical — the same pattern that recurs across every major Lazarus operation.

The Structural Mistakes That Made It Possible

Three errors in Ronin's design that, if any one of them had been corrected, would likely have prevented the hack:

1. Insufficient validator count and independence

Nine validators with a five-of-nine threshold sounds reasonable but isn't, when the validators aren't sufficiently independent. Sky Mavis controlled four directly. The Axie DAO controlled one (which Sky Mavis had been allowlisted to sign on behalf of). That's effectively five Sky-Mavis-controlled signatures available to anyone with deep enough access to Sky Mavis's systems. Modern bridges usually use larger validator sets (15+, sometimes 30+) with much stricter independence requirements among operating parties.

2. Stale allowlist permissions

The Axie DAO allowlist that Sky Mavis used in November 2021 should have been revoked when the underlying need ended in December 2021. It wasn't. Four months later, the unrevoked permission was the difference between four compromised validator keys (insufficient for a transfer) and five (sufficient). Permissions in security-critical systems should expire by default and require affirmative renewal. Post-Ronin this became a standard architectural requirement for bridges; it wasn't before.

3. No continuous withdrawal monitoring

A bridge holding hundreds of millions of dollars should have automated alerting on any transfer that deviates from historical patterns. Sky Mavis's bridge had none. The hack was discovered six days later by a user who couldn't withdraw 5,000 ETH — an obviously inadequate monitoring posture. Post-Ronin, continuous bridge monitoring is now a baseline expectation for any bridge holding nine-figure reserves.

How Ronin Compares to the Bybit Hack

Both Ronin (March 2022) and Bybit (February 2025) were Lazarus operations targeting trusted infrastructure rather than exploiting smart-contract logic. The differences across three years tell the story of how both attacker sophistication and forensic-response capability have evolved.

The trajectory is striking. In 2022, Lazarus had six days of unobserved possession, weeks before public attribution, and months to complete laundering with limited interference. In 2025, the same group had hours of unobserved possession, public attribution within the hour, and aggressive industry-wide freeze coordination from day one. The attackers got more sophisticated; the defenders got dramatically faster.

THE BYBIT HACK WAS THE LARGEST FINANCIAL HEIST IN HISTORY

Bybit sustained losses of $1.4 Billion at the time of the hack, 21st Feb 2025. The closest competitor is the theft from the Central Bank of Iraq, which lost $1 Billion on 18th March 2003.

— Arkham (@arkham) February 24, 2025

that Arkham's framing puts Ronin's $625M not far behind the all-time-high category for years until the Bybit hack itself eclipsed it three years later. The dollar magnitude that felt unprecedented in March 2022 became a benchmark that later state-sponsored operations explicitly set out to beat.

Both cases also show why working investigators study Lazarus specifically: the operator is consistent enough across operations that pattern recognition becomes a primary attribution tool. The same DEXs in the same sequence, the same bridges, the same mixers. Once you've seen the playbook once, you recognize it on sight. We cover this attribution methodology in OSINT for blockchain forensic investigators.

What Forensic Investigators Take From the Case

Five working lessons from Ronin that apply to every modern investigation:

1. Validator/key compromises are rarely about the cryptography

The Ronin attackers didn't break Ethereum's signature scheme. They broke a person who opened a Word document. Every later state-sponsored crypto theft has used some version of the same vector — social engineering against a senior employee with privileged access. The cryptography is sound; the humans are the targetable layer.

2. Stale permissions are existential

The Axie DAO allowlist not being revoked wasn't the most likely cause of the hack — it was the necessary condition. Four compromised keys were insufficient. The unrevoked permission turned an attempted breach into a successful one. Permissions in security-critical systems should expire by default. Anyone running a multisig setup who hasn't audited their permission graph in the last six months is one stale grant away from a Ronin-style outcome.

3. Detection latency is the multiplier on damage

Six days of unobserved possession let Lazarus organize their laundering at a leisurely pace. Modern bridge architecture treats sub-hour detection as the baseline. The forensic implication: when you're working a case where the detection gap was substantial, expect the laundering pipeline to be more thorough and the initial fragmentation to be more sophisticated. Slow detection produces high-quality laundering.

4. OFAC sanctions are now a primary forensic lever

Ronin is the case where OFAC's role expanded from "post-facto labeling of bad actors" to "active forensic infrastructure." Once the SDN list includes specific addresses, every U.S.-touching exchange must screen against them, which means traceable funds reaching those exchanges become recoverable. For modern investigations, identifying that case wallets cluster with sanctioned entities is one of the highest-ROI moves possible.

5. The Lazarus playbook is studyable

Across Phemex, Ronin, WazirX, Bybit, and other DPRK-attributed operations, the same operational patterns recur: spear-phishing for initial access, compromise of trusted infrastructure rather than smart-contract exploits, immediate fragmentation, mixer-based laundering, off-ramping through P2P and non-cooperative exchanges. Working investigators should be able to recognize the playbook on sight. That recognition is what made ZachXBT's Bybit attribution within hours possible — he wasn't doing first-principles analysis; he was matching against a pattern he'd seen before. We integrate this kind of behavioral attribution as standard practice in our blockchain forensic analysis work.

Frequently Asked Questions

Final Thoughts

Ronin is the case that changed crypto's relationship with state-sponsored adversaries. Before Ronin, the assumption among most operators was that nation-state actors weren't really paying attention to DeFi — the attack surface was new, the dollar amounts were modest by national-budget standards, and the targets seemed too retail to be worth the operational cost. Ronin showed that all of those assumptions were wrong. North Korea was paying attention, the dollar amounts had grown enough to fund significant portions of the regime's foreign currency needs, and the attack surface was large enough to support sustained operations.

Every major DPRK-attributed crypto theft since — including the $1.46B Bybit hack, which dwarfs Ronin in absolute scale — has built on what Ronin established. The forensic methodology, the OFAC sanctions framework, the bridge security architecture, the public-private response infrastructure: all of it took shape in the year following the Ronin hack. For a working investigator, studying Ronin in detail is the prerequisite for understanding the landscape that followed.

If you're working a case where the attribution patterns look familiar — spear-phishing entry, key compromise rather than smart-contract exploit, immediate fragmentation, Tornado-style mixing — the operator is probably not original. The playbook is well-known. Get in touch if you'd like a forensic walkthrough of your specific case against the playbook.