Curriculum·G705 Scam Response for Community Leaders·about 31 min

Detection, disclosure and the cost of silence

By the end of this lesson you can

→State what was taken from the Ronin bridge in March 2022, how, and how and when it was discovered
→Explain why detection is the longest clock in most incidents, and what it means that the largest theft in the sector to that date was found by a customer
→Compute the undetected window and what monitoring at the bridge's own cadence would have caught, and read the cost of six days against the cost of an alert
→Write a disclosure schedule: what is said at discovery, at containment, at attribution and at the postmortem, and what is never said before it is known

Graduate · enrolled learners

This lesson opens with The Ronin Network bridge, 23 to 29 March 2022.

What happened: On 23 March 2022 an attacker used five of the nine validator signatures that secured the Ronin bridge, the sidechain built by Sky Mavis for Axie Infinity, to sign two withdrawals: 173,600 ETH and 25.5 million USDC, about $625 million at the time. Four of the keys were Sky Mavis's own validators and the fifth signature came from the Axie DAO validator: in November 2021 Axie DAO had allowlisted Sky Mavis to sign on its behalf during a surge of free transactions, the arrangement ended the next month, and the permission was never revoked. Nobody at the company noticed. On 29 March, six days later, a user reported being unable to withdraw 5,000 ETH from the bridge, and the investigation that followed found the transactions. Sky Mavis froze the bridge, published a statement, promised that users' funds would be covered, and on 14 April 2022 the FBI attributed the theft to North Korea's Lazarus Group and APT38. The bridge reopened on 28 June 2022, with Ronin saying all users had been made whole and a circuit breaker added for suspiciously large withdrawals.
The decision point: Two withdrawals worth about $625 million sat on a public chain for six days, and the company that ran the bridge learned of them from a user who could not withdraw. Per Halborn's analysis there was no monitoring that caught it, and a validator permission that had been granted for one purpose had been left in place; in this lesson's reading an alert on large withdrawals or a reconciliation of the bridge's balance against its liabilities would have caught it. Everything after discovery, the freeze, the statement, the reimbursement, the attribution, was done well and is the model for the disclosure schedule in this lesson. Everything before it is the lesson about detection: the incident was not six days long because the attack took six days, but because nobody was watching a number that a single line of monitoring would have flagged in minutes.
Recorded loss: $625,000,000

What you will be able to answer

→What happened at Ronin in March 2022?
→Why was the incident six days long?
→The disclosure schedule's four slots?
→What is never said before it is known?

Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.

It is free. We do not sell the list and there is nothing to buy at the end of it.

Enroll, it is free Sign in Start at the beginning

Terms used here

Multisig Bridge

Sources and review

Confidence high·Volatility low·Reviewed 2026-09-14·Owner unassigned

Contested

The dollar value is the widely reported figure at the time of discovery and moved with prices. The reimbursement and the reopening of the bridge are from later company statements and are cited as context rather than as part of the incident's mechanism.

J301-04 owns bridge risk as an architecture question and uses this incident for that purpose. This lesson uses it for detection and disclosure only. Keep the split.

← Containment and the response clock After: the second wave and the postmortem →