Curriculum·G205 Monitoring, Alerting, and Response·about 31 min

What to watch, and the outflow nobody watched

By the end of this lesson you can

→Distinguish a public ledger from a monitored one, and explain why publication is not observation
→Explain how a 624 million dollar outflow from the Ronin bridge went unnoticed for six days
→Compute what a user should watch on a position they hold: outflows, permission changes, and control changes
→Set up an alert on the events that would tell you a position is being drained while it is happening

Graduate · enrolled learners

This lesson opens with Ronin bridge, 23 March 2022.

What happened: The Ronin bridge connected Ethereum to Ronin, the sidechain built for the Axie Infinity game. Withdrawals were authorized by five of nine validator signatures. The attacker gained control of five validators, four run by the operator Sky Mavis and a fifth run by the Axie DAO, which in November 2021 had allowlisted Sky Mavis to sign transactions on its behalf during a period of heavy user load; the arrangement ended in December and the allowlist was never revoked. With five signatures the attacker made two withdrawals that emptied the bridge of about 624 million dollars. Every one of those transactions was published on the chain in real time. Nobody saw them: the theft was discovered six days later, on 29 March, when a user tried to withdraw 5,000 ether and could not, and asked why. The FBI later attributed the theft to Lazarus Group and APT38, cyber actors associated with North Korea. The chain recorded the largest crypto theft to that date as it happened, and the protocol was watching none of it.
The decision point: The Ronin outflow was not hidden. It was on a public chain, visible to anyone who looked, from the moment it happened. The gap that let 624 million dollars sit stolen for six days was that publication is not observation: a ledger that records everything protects no one unless someone, or something, is reading it against a rule for what should not happen. This is the premise of the whole course. A user cannot audit code or run a validator, but they can decide what a healthy position looks like and set an alarm for the events that would say it is not, a large outflow, a change of ownership, a new approval, so that the six days between a drain and its discovery becomes minutes. The chain gives everyone the same real-time feed; monitoring is the decision to actually watch it.
Recorded loss: $624,000,000

What you will be able to answer

→How long did the Ronin theft go unnoticed, and how was it found?
→Why did a public 624 million dollar outflow go unseen?
→What should a user watch on a position they hold?
→What is monitoring, given the chain already publishes everything?

Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.

It is free. We do not sell the list and there is nothing to buy at the end of it.

Enroll, it is free Sign in Start at the beginning

Terms used here

Multisig Bridge

Sources and review

Confidence high·Volatility medium·Reviewed 2026-09-14·Owner unassigned

Contested

Rekt puts the Ronin loss at about 624 million dollars, the value of 173,600 ether and 25.5 million USDC at the time; the FBI's attribution statement says 620 million dollars, and other outlets round to 625 million. The six-day gap between the 23 March theft and its 29 March discovery is documented in Sky Mavis's own community alert.

Sky Mavis's postmortem says one employee was compromised through spear-phishing and the attacker used that access to reach the four Sky Mavis validators, then used the gas-free RPC node and the un-revoked Axie DAO allowlist to obtain the fifth signature.

← Curriculum The compromise that leaves no on-chain trace →