Ronin ran on nine validators — five keys were enough to steal $620M

Ronin was the sidechain bridge that Sky Mavis built for Axie Infinity, the play-to-earn game whose players used it to move funds in and out of the game's economy. Withdrawals from the bridge needed the signatures of five of its nine validator nodes — and four of the nine were run by Sky Mavis itself. In November 2021, while user numbers surged, the Axie DAO allowed Sky Mavis to sign transactions on behalf of its validator node to handle the load. That arrangement was discontinued in December 2021 — but the access was never revoked.

The attackers found the leftover backdoor through Sky Mavis's gas-free RPC node and used it to obtain the Axie DAO validator's signature. Holding five of the nine keys, they forged withdrawals on 23 March 2022: 173,600 ETH, worth about $594.6 million at the time, and $25.5 million in USDC — roughly $620 million in total. The theft went undisclosed for six days: Ronin announced it on 29 March, pausing the bridge and the Katana exchange.

Sky Mavis said it was working with law enforcement, forensic cryptographers and its investors 'to make sure all funds are recovered or reimbursed,' raised the validator threshold from five to eight, migrated nodes to completely separated infrastructure and engaged Chainalysis to track the stolen funds. But the money that left the bridge was users' money — and when the announcement came, holders still did not know what would happen to their funds or when.