The Game That Paid Bills and the Five-Signature Breach: Ronin’s Nearly $620M Lazarus Theft

1. Cabanatuan: When Axie Earnings Entered Household Budgets

In 2020 and 2021, the pandemic gave Axie Infinity an unusual role in Cabanatuan, Philippines. CoinGecko reported examples of players cashing out game earnings to pay bills, support their families and cover school costs, and linked to a short documentary about the community. These were examples of household support, not a promise of income for every player.^[1]

The household examples centered on SLP (Smooth Love Potion) earned through Axie’s Play-to-Earn (P2E) model. CoinGecko described converting SLP into another cryptocurrency and then into pesos. That route connected game rewards to spending money, with the amount received depending on the token’s exchange value.^[1]

A starting team cost more than many prospective players could afford, so asset owners lent Axie NFTs through scholarships and split the resulting SLP income. CoinGecko reported examples near PHP 15,000 a month, compared with roughly PHP 10,000 for some local jobs. By October 5, 2021, Sky Mavis said Axie had more than two million daily active players, but that total was not a count of scholars or Filipino users.^[1][2]

2. Ethereum Friction and Ronin’s Concentrated Bridge

Axie’s growth ran into Ethereum congestion. Sky Mavis said slow confirmations and gas costs disrupted the game economy, especially the small, frequent transactions on which Axie depended.^[4]

Sky Mavis built Ronin as an Ethereum-linked sidechain. Its launch posts promised fast confirmation and sharply lower fees; on April 28, 2021, Phase 2 moved ETH, AXS, SLP, breeding, claims, and marketplace activity onto Ronin.^[3][4]

The bridge that connected Ronin to Ethereum used nine validators and required five signatures for a withdrawal. A later Japanese regulatory research report found that Sky Mavis operated four of those nodes. The threshold therefore concealed a concentration problem: one organization already controlled four of the five signatures an attacker needed.^[6]

3. The Malicious PDF and an Authorization Left Behind

The attackers did not break Ethereum’s cryptography. A U.S. Treasury risk assessment says North Korea-linked actors sent a malware-bearing PDF to a single engineer and used that access to reach four of the five validator nodes needed to control the bridge.^[7]

A single personnel breach became a network-level failure because the compromised access reached four validator nodes operated by Sky Mavis. The malicious document mattered at bridge scale because those four nodes did not form independent lines of defense.^[7]

The fifth signature came through an old Axie DAO validator arrangement. During heavy traffic in November 2021, the DAO let Sky Mavis sign on its behalf so users could make free transactions. That temporary action ended in December, but the proxy-signature authorization list was not removed.^[6]

The FSA-commissioned report links the compromise of the DAO validator to the proxy-signature permission left in place after the temporary arrangement ended. That old authorization extended the effect of the Sky Mavis breach to the fifth signature needed for a withdrawal.^[6]

4. Two Withdrawals, Six Days Without Detection

On March 23, 2022, the bridge recorded two unauthorized withdrawals: 173,600 ETH at 13:29:09 UTC and 25.5 million USDC at 13:31:04 UTC. The on-chain timestamps are one minute and 55 seconds apart.^[9][10]

The Japanese FSA-commissioned report valued the assets at $620.1 million at the time. In May 2022, the U.S. Treasury described the Lazarus operation as the largest virtual-currency heist to date and valued it at almost $620 million. That description records the scale as Treasury measured it in May 2022.^[6][8]

The breach remained undiscovered until March 29, when a user could not withdraw ETH. Six days had passed since the unauthorized transactions. When the bridge reopened, its new defenses included circuit breakers and daily withdrawal limits intended to stop another large withdrawal from passing unchecked.^[6][11]

5. Users Repaid, the DAO Exception, and a 21-Validator Target

On April 14, 2022, the U.S. government linked the address to North Korea’s Lazarus Group; a May Treasury action repeated the attribution and identified the March 23 Ronin theft.^[8]

Sky Mavis announced that Binance would lead a $150 million funding round, but later updated the post to say only $11 million was raised. The company said it used its own balance sheet to refill the bridge. When the bridge reopened, ordinary users’ WETH and USDC liabilities were backed, while 56,000 WETH belonging to the Axie DAO Treasury remained undercollateralized pending recovery or the DAO’s decision. Before the June reopening, Binance had offered an alternative from April 2 for users able to use its service, supported by liquidity from Axie Infinity and the founding team.^[5][11]

We take full responsibility for the breach.^[5]

— Sky Mavis, April 6, 2022

Ronin reopened with a higher signature threshold, withdrawal limits, circuit breakers, and human review for large transfers. Sky Mavis also set a goal of at least 21 independent validator nodes within three months and began onboarding Nansen, Delphi Digital, Stable Node, Animoca Brands, and Dialectic. The 21-node figure belonged to the recovery roadmap rather than the validator count already in service.^[11][12]