Ronin’s $600M Hack: What Happened and What to Do

The Ronin hack was a bridge theft discovered on March 29, 2022. The FBI attributed it to Lazarus Group, a North Korea-linked hacking group. Attackers stole 173,600 ETH and 25.5 million USDC from the Ronin Bridge; the assets were worth roughly $600 million at the time, with some estimates higher depending on valuation. The bridge was paused and later reopened after security changes.

Ronin is an EVM-compatible gaming chain built to support games including Axie Infinity. Its bridge lets users move assets between Ronin and Ethereum. The incident mattered because the bridge held assets on one network while relying on a small set of validators to authorize transfers on another. When the attackers gained enough validator access, they could make withdrawals the system treated as valid.

If you’re deciding whether to use Ronin now, treat the hack as a reason to verify the bridge and each transaction carefully—not as proof that every current Ronin transaction is compromised. Check the destination, token, amount and fees before signing.

The theft took place on March 23, 2022, but Ronin’s team did not discover it until March 29. That gap is central to understanding the incident: the fraudulent withdrawals had already been approved and recorded before they were noticed.

A short timeline:

• March 23: Attackers withdrew 173,600 ETH and 25.5 million USDC through the Ronin Bridge.
• March 29: A user reported being unable to withdraw 5,000 ETH. The team investigated and found the much larger unauthorized withdrawals.
• After discovery: Ronin paused the bridge while it investigated and worked on security changes.
• April 2022: U.S. authorities publicly linked the theft to Lazarus Group and sanctioned the Ethereum address associated with the stolen funds.
• June 2022: The bridge reopened after security upgrades and reviews.

The reported dollar total varies because crypto prices move. “About $600 million” is a useful shorthand, not a precise fixed value. The quantity of ETH and USDC is more specific than any conversion into dollars.

The Ronin Bridge depended on validator approvals to authorize withdrawals. At the time, a withdrawal required signatures from five of nine validators. Attackers obtained access to four validators operated by Sky Mavis and one validator associated with Axie DAO, reaching that threshold.

With enough keys, they could submit withdrawals that passed the bridge’s checks. The bridge then released assets held on Ethereum. This was not a case of hackers guessing individual players’ wallet passwords or stealing each user’s private key. It was a failure in the system that authorized movement of pooled bridge assets.

The incident also showed how operational access can undermine a technically functioning system. A bridge can verify that the required keys signed a transaction and still be vulnerable if attackers have taken control of those keys. For users, the practical lesson is to consider who controls a bridge’s validators, how many approvals are required, and what happens if keys are compromised. A familiar chain or game name does not remove those risks.

The FBI attributed the theft to Lazarus Group, which U.S. authorities describe as linked to North Korea. The U.S. Treasury also added an Ethereum address associated with the stolen funds to its sanctions list in April 2022. These government actions support the attribution; they do not publicly identify every person involved or expose every step of the investigation.

Lazarus is a label used for a group of North Korea-linked cyber operators. Attribution usually draws on multiple kinds of evidence, such as technical indicators, patterns of activity and intelligence. It is not the same as catching a named individual in the act, so it is more accurate to say the theft was attributed to Lazarus than to claim that the perpetrators’ personal identities are known.

For Ronin users, the responsible party does not change the basic security lesson: bridge custody and validator access were critical points of failure. Avoid relying on rumours about who was involved, and be especially wary of messages claiming to offer insider details, compensation or a way to recover stolen assets in exchange for a fee or your wallet credentials.

The immediate response was to stop further bridge withdrawals while Ronin investigated and changed its security arrangements. The bridge later reopened in June 2022 after upgrades and reviews. That response was intended to address the attack path, but a past review or upgrade cannot guarantee that a bridge will never face another vulnerability or operational failure.

The stolen amount was large enough to make the incident one of crypto’s major bridge exploits. It also highlighted a broader risk: bridges often depend on systems that coordinate assets across separate blockchains. If a bridge’s validators, keys, software or operational processes fail, users can lose access to assets even when their own wallets were not hacked.

The historical theft does not mean your wallet automatically needs to be replaced. If you held assets on Ronin at the time, check your own transaction history and any official account or recovery information relevant to your situation. If you are using Ronin today, confirm the current bridge status through trusted Ronin channels and review the transaction details in your wallet. Don’t assume a past announcement covers today’s route, token or fee.

Before transferring assets through Ronin or another bridge, use this checklist:

1. Confirm the route. Check that you selected the intended source and destination networks, and that the asset is supported on both.
2. Verify the transaction in your wallet. Read the token, amount, destination and requested permissions. Cancel if the details differ from what you expected.
3. Check fees and timing. Network fees vary, and bridge transfers may take time. Review the displayed cost before you sign; don’t rely on an old estimate.
4. Use a small test transfer when practical. It can help catch a wrong network or destination before you move a larger amount, though it does not eliminate bridge risk.
5. Keep your recovery phrase private. A legitimate bridge or support agent should not ask you to send it.

A wallet signature is an authorization, not merely a login. If a transaction requests a broad token allowance, make sure you understand what it permits. Consider limiting an approval to the amount needed where the wallet and application allow it. Keep a record of transaction IDs so you can investigate a transfer that appears delayed or incorrect.

The Ronin incident is a useful reminder to separate wallet security from bridge security. Protecting your recovery phrase helps prevent someone from taking over your wallet, but it does not protect assets held by a bridge if the bridge’s own authorization system is compromised.

Avoid these common mistakes:

• Assuming a familiar name guarantees safety. Check the exact network and application you are using; scammers can imitate legitimate services.
• Signing without reading. A transaction can approve a transfer or token allowance. Stop if the wallet shows an unexpected asset, recipient or permission.
• Sending everything in one transfer. A test transaction can reduce the chance of a simple routing mistake, although it cannot prevent a protocol failure.
• Trusting recovery offers. Scammers often target victims of major hacks with fake reimbursement or tracing services. Do not pay someone who promises guaranteed recovery or asks for your seed phrase.
• Treating old security claims as permanent. Bridge software, operators and risks can change. Check current information before each transfer.

If you suspect you signed a malicious approval, stop using the affected app, review and revoke suspicious permissions through a trusted wallet tool, and move remaining assets to a secure wallet if you can do so safely. Never share your recovery phrase to get help.

The Ronin hack was a 2022 theft caused by attackers gaining control of enough validator keys to approve bridge withdrawals. The FBI attributed it to Lazarus Group, a North Korea-linked hacking group. The episode showed that users can face bridge-level risks even when their own wallet credentials remain private.

If you’re using Ronin in 2026, focus on the transaction in front of you: verify the official route, network, token, destination and permissions; check the current fee; and keep your recovery phrase offline and private. For a transfer you can’t afford to lose, consider whether bridging is necessary and whether you understand the risks of both networks and the bridge operator.

The Ronin chain remains relevant to gaming and other applications, but no chain or bridge can promise zero risk. Make decisions based on the current transaction and the amount you can afford to put at risk—not on the fact that a bridge was reopened or previously reviewed.