Ronin Network bridge hack (Axie Infinity)
The Ronin bridge behind the game Axie Infinity was drained of about $625M in ETH and USDC in March 2022 after attackers obtained validator keys. U.S. authorities attributed the theft to North Korea's Lazarus Group, and OFAC sanctioned the wallet.
Also known as: Ronin Network, Ronin bridge, Axie Infinity, Sky Mavis
Summary
Ronin is an Ethereum sidechain built by Sky Mavis to support the play-to-earn game Axie Infinity. In March 2022, attackers compromised validator private keys and drained about 173,600 ETH and 25.5 million USDC — roughly $625 million — in one of the largest crypto thefts on record. [1][2]
Attribution
The U.S. Treasury and FBI attributed the attack to the Lazarus Group, a hacking unit linked to North Korea, and OFAC added the receiving wallet address to its sanctions list. Sky Mavis reimbursed users after raising additional funding. [1][2]
Bracketed numbers refer to the numbered sources listed below.
People & entities involved
- Lazarus GroupAttributed actorOrganizations & groupsThe most widely used name for North Korea's state-sponsored hacking apparatus, run under its Reconnaissance General Bureau. Blamed for the Sony hack, the Bangladesh Bank SWIFT heist, WannaCry, and — since ~2017 — many of the largest crypto thefts ever. Chainalysis puts DPRK's cumulative crypto haul near $6.75B, used to fund the regime's weapons programs.
- TraderTraitorAttributed actorOrganizations & groupsA North Korea-linked threat cluster (part of the Lazarus umbrella) that the FBI blames for several of the largest exchange thefts, including Bybit ($1.5B), DMM Bitcoin ($305M), and the Ronin/Axie bridge. It favors social-engineering of employees and supply-chain compromises.
Sources (2)
See also
- Loci (LOCIcoin)TokensA 2017–2018 ICO for 'LOCIcoin' tied to the InnVenn IP-search platform. The SEC charged Loci and CEO John Wise with fraud for raising $7.6M on false claims about revenue, headcount, and user base; Wise also misused investor funds. Settled with a $7.6M penalty and an officer/director bar.
- Blockchain Terminal (BCT)TokensA 2017–2018 ICO (BCT tokens, ~$30M) for a 'Blockchain Terminal' — a Bloomberg-style crypto trading terminal. The SEC and DOJ said convicted ex-hedge-funder Boaz Manor secretly ran it under a fake identity ('Shaun MacDonald'), using associate Edith Pardo as a front, and lied about the product's adoption.
- Crowd Machine (CMCT)Tokens
This page was last updated on Jun 8, 2026. View revision history.