Curriculum·S205 On-Chain and Fundamental Data·about 30 min
The explorer as an analyst tool
By the end of this lesson you can
- →Query an address, a contract and a token from an explorer and extract the four facts an analyst needs
- →Explain why public data is not the same as watched data, and what that gap is worth
- →Read a contract's permissions and holder distribution without reading code fluently
- →Set up a monitoring query so that a change reaches you rather than waiting to be found
Sophomore · enrolled learners
This lesson opens with The six days nobody looked at the Ronin bridge.
- What happened
- On 23 March 2022 an attacker withdrew approximately 173,600 ETH and 25.5 million USDC, around $625M, from the Ronin bridge, using four compromised validator keys plus a fifth signature obtained through an allowlist entry that had outlived its purpose. Every one of those withdrawals settled on a public ledger and was queryable from the moment it confirmed. The breach was not discovered until 29 March, when a user was unable to withdraw funds and raised it. Six days elapsed between the largest bridge theft recorded and anybody noticing, on data that was continuously public throughout.
- The decision point
- There was no information problem. The transactions were visible, permanent and free to query from the instant they occurred, and the bridge's balance fell by a quantity that any monitoring query would have surfaced immediately. What was missing was somebody looking. Public and watched are different properties, and only the first is a feature of the technology.
- Recorded loss
- $625,000,000
What you will be able to answer
- →What is the difference between public and watched?
- →Name the four facts to extract from a token's explorer page.
- →What does a verified contract badge certify?
- →Why set up a monitoring query rather than checking manually?
Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.
It is free. We do not sell the list and there is nothing to buy at the end of it.
Sources and review
- https://www.halborn.com/blog/post/explained-the-ronin-hack-march-2022
- https://www.coindesk.com/tech/2022/03/29/axie-infinitys-ronin-network-suffers-625m-exploit
- https://docs.etherscan.io/
- https://ethereum.org/en/developers/docs/transactions/
Confidence high·Volatility high·Reviewed 2026-08-06·Owner unassigned
Contested
F109-01 uses Ronin to teach delegation that outlives its purpose. This lesson uses the six-day detection gap to teach that public data is not watched data. Keep the split; if a revision starts explaining the allowlist mechanism here, that content belongs in F109-01.
Explorer interfaces and the specific tabs and labels described here change frequently. Teach what to look for rather than where to click, and re-check any interface detail at review.