Curriculum·G205 Monitoring, Alerting, and Response·about 30 min
What to watch, and the outflow nobody watched
By the end of this lesson you can
- →Distinguish a public ledger from a monitored one, and explain why publication is not observation
- →Explain how a 625 million dollar outflow from the Ronin bridge went unnoticed for six days
- →Compute what a user should watch on a position they hold: outflows, permission changes, and control changes
- →Set up an alert on the events that would tell you a position is being drained while it is happening
Graduate · enrolled learners
This lesson opens with Ronin bridge, 23 March 2022.
- What happened
- Ronin is the bridge that settles the Axie Infinity game. Withdrawals were authorized by five of nine validator signatures. The attacker gained control of five keys, four held by the operator Sky Mavis and a fifth belonging to the Axie DAO, whose signing permission Sky Mavis had been granted months earlier to clear a transaction backlog and had never revoked. With five keys the attacker signed two withdrawals that emptied the bridge of about 625 million dollars. Every one of those transactions was published on the chain in real time. Nobody saw them: the theft was discovered six days later, on 29 March, when a user tried to withdraw 5,000 ether and could not, and asked why. The FBI later attributed the operation to the North Korea-aligned Lazarus group. The chain recorded the largest crypto theft to that date as it happened, and the protocol was watching none of it.
- The decision point
- The Ronin outflow was not hidden. It was on a public chain, visible to anyone who looked, from the moment it happened. The gap that let 625 million dollars sit stolen for six days was that publication is not observation: a ledger that records everything protects no one unless someone, or something, is reading it against a rule for what should not happen. This is the premise of the whole course. A user cannot audit code or run a validator, but they can decide what a healthy position looks like and set an alarm for the events that would say it is not, a large outflow, a change of ownership, a new approval, so that the six days between a drain and its discovery becomes minutes. The chain gives everyone the same real-time feed; monitoring is the decision to actually watch it.
- Recorded loss
- $625,000,000
What you will be able to answer
- →How long did the Ronin theft go unnoticed, and how was it found?
- →Why did a public 625 million dollar outflow go unseen?
- →What should a user watch on a position they hold?
- →What is monitoring, given the chain already publishes everything?
Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.
It is free. We do not sell the list and there is nothing to buy at the end of it.
Sources and review
- https://rekt.news/ronin-rekt/
- https://roninblockchain.substack.com/p/community-alert-ronin-validators
- https://docs.openzeppelin.com/defender/module/monitor
Confidence high·Volatility medium·Reviewed 2026-09-14·Owner unassigned
Contested
The Ronin loss is reported at about 625 million dollars, comprising roughly 173,600 ether and 25.5 million USDC at the time. The six-day gap between the 23 March theft and its 29 March discovery is documented in Sky Mavis's own community alert.
The Axie DAO's un-revoked signing permission is well documented as the fifth compromised key; the precise method by which the four Sky Mavis validator keys were compromised involved social engineering and is described in later attributions.