Ronin bridge hack (2022)
The theft of about 620 million dollars in crypto assets in March 2022 from the Ronin bridge of the game Axie Infinity, attributed by the FBI to North Korea's Lazarus group, whose address was sanctioned right away.
A cross-chain bridge holds the assets users move from one network to another, and releases funds when enough validators sign the transaction. Ronin's required five signatures out of nine, four of which were controlled by the same company. The attackers obtained those four keys, then a fifth through a forgotten access permission, and drained the bridge; the theft was not discovered until six days later. The case ties cyber directly to political risk: the funds went to a sanctioned state, which uses such proceeds to finance its weapons programs. Once attribution was made, any transaction with the thieves' address became illegal for a US person, ruling out negotiating for or buying back the funds.
On March 23, 2022, the attackers withdrew 173,600 ether and 25.5 million USDC, about 620 million dollars, from the bridge operated by Sky Mavis. On April 14, 2022, the FBI attributed the theft to the Lazarus group, and OFAC added the thieves' address to its sanctions list the same day.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.