Ronin Bridge hack (Axie Infinity)

On March 23, 2022, attackers compromised five of the nine validator keys securing the Ronin Network, the Ethereum sidechain built by Sky Mavis for the game Axie Infinity, and approved two withdrawals from the Ronin bridge totaling 173,600 ETH and 25.5 million USDC — about $625 million at the time, then the largest DeFi hack on record. The breach went unnoticed until March 29, when a user could not withdraw ETH. (Reported loss figures range from ~$540M at transaction time to $612M-$625M at disclosure; $625M is the most widely cited.)

On April 14, 2022, the FBI attributed the attack to North Korea's Lazarus Group, and OFAC added the attacker's Ethereum address to its Lazarus Group SDN designation. The group laundered funds through more than 12,000 addresses in a five-stage process centered on Tornado Cash; OFAC's August 2022 sanctioning of Tornado Cash cited over $455 million laundered from this heist.

Recovery has been partial but ongoing: in September 2022, US law enforcement working with Chainalysis seized over $30 million — the first-ever seizure of DPRK-stolen crypto (~10% of the haul). Norway's Økokrim seized roughly $5.9 million in 2023 and returned $5.7 million to Sky Mavis in June 2024, with about $40 million more frozen by law enforcement. Sky Mavis raised $150 million in April 2022 (led by Binance), reimbursed all users, and relaunched the bridge on June 28, 2022. No individual has been indicted specifically for the Ronin theft; Lazarus remains active and executed the $1.5 billion Bybit hack in February 2025.

Sources: [Chainalysis](https://www.chainalysis.com/blog/axie-infinity-ronin-bridge-dprk-hack-seizure/), [CoinDesk](https://www.coindesk.com/policy/2022/04/14/us-officials-tie-north-korean-hacker-group-to-axies-ronin-exploit), [CyberScoop](https://cyberscoop.com/ronin-bridge-hack-lazarus-group-north-korea-treasury-sanctions/), [Cointelegraph](https://cointelegraph.com/news/sky-mavis-recovers-5-7m-ronin-bridge-hack), [CoinDesk](https://www.coindesk.com/business/2022/04/06/sky-mavis-raises-150m-round-led-by-binance-to-reimburse-ronin-attack-victims)

**Official action:** FBI attribution to Lazarus Group and OFAC SDN designation of attacker ETH address, Apr 14, 2022; OFAC Tornado Cash sanctions Aug 2022; ~$30M US seizure Sept 2022; Norway Okokrim seizure and $5.7M return to Sky Mavis, June 2024