ChainHintbeta
    Case Studies/Ronin Bridge
    Ronin Bridge

    Ronin Bridge Hack: $625M Stolen

    March 23, 2022 · Ronin / Ethereum · Lazarus Group

    stolen
    $625M
    validators compromised
    5/9
    undetected
    6 days
    group
    Lazarus 🇰🇵

    What was reported, and what we traced

    Estimated Loss
    $625Mas publicly reported
    Traced Outflow · ChainHint
    $572Mpriced at time of incident

    ChainHint traced $572,067,519 out of the attacker address across 267 addresses and 796 transfers.

    Open the graph behind this figure

    What happened

    On March 23, 2022, Lazarus Group executed the second-largest crypto theft in history by compromising the Ronin bridge — the sidechain powering Axie Infinity. Through a spear-phishing attack disguised as a fake job offer, attackers obtained private keys to 5 of 9 Ronin validator nodes, granting them unilateral withdrawal authority. Two fraudulent transactions drained 173,600 ETH and 25.5M USDC from the bridge contract. The breach went undetected for six days until a user reported an inability to withdraw funds. US Treasury attributed the attack to Lazarus Group in May 2022 and sanctioned the exploiter address.

    How the funds moved

    Step 1

    Validator Key Theft

    Lazarus delivered a fake job offer PDF to a Sky Mavis senior engineer via spear-phishing. Malware granted remote access and exfiltrated private keys for 4 Sky Mavis validators. A 5th key from the Axie DAO was obtained through a previously granted allowlisting permission.

    Step 2

    Silent Drain

    Two withdrawal transactions — 173,600 ETH and 25.5M USDC — executed against the Ronin bridge contract on March 23. With 5 of 9 keys controlled, the multisig threshold was met. The breach went undetected for 6 days.

    Step 3

    Laundering

    Funds routed through Tornado Cash and on to centralised exchange deposit addresses. Binance later froze approximately $5.8M linked to the exploit after attribution by US Treasury.

    Where the funds went

    Read from the transfers in ChainHint's trace, not from press reports

    First transfer
    Mar 23, 2022
    Last transfer traced
    Nov 5, 2025
    Hops traced
    6
    DEX swaps
    2
    First hop out of the attacker's address
    $547METH
    $25.5MUSDC

    ChainHint's trace of the Ronin Bridge hack follows 796 transfers across 267 addresses and 6 hops, between Mar 23, 2022 and Nov 5, 2025. The first hop out of the attacker's address moved ETH ($547M), USDC ($25.5M). 2 of the transfers are DEX swaps.

    Visualized attack path

    267 addresses · 796 transfers · Traced with ChainHint

    Ronin Bridge Investigation Summary
    View Investigation →
    Ronin Bridge Fund Flow Graph
    View Interactive Graph →

    Key findings

    Exploiter Address

    0x098b…2f96Ronin Bridge Exploiter — OFAC sanctioned May 2022
    US OFACLazarus Group

    Attack Vector

    Validator key compromise (5/9)Spear-phishing via fake LinkedIn job offer. No smart contract vulnerability — pure key theft.
    Social Engineering

    Primary Laundering

    Tornado Cash + CEX depositsMultiple hops through Tornado Cash, then secondary deposits at exchange addresses

    Attribution

    Lazarus Group (DPRK)Confirmed by US Treasury OFAC designation — May 6, 2022

    Investigate your own incident

    ChainHint traced the Ronin Bridge hack in minutes.
    Use the same tool for your case.