Ronin Network
Last changed 2026-10-10 · Score recalculated — Rescored under Scoring v2, the published formula (avoid.net/scoring): 22 → 61. Problems weighed by who is responsible: incidents the subject suffered −19.2, concerns that are not fraud −3.2, problems around the subject, caused by others −0.8; legitimacy credit well known and widely used +15, long-running +4. Version history →
Why this score
| Every page starts at | 65 |
| Concerns that are not fraud | -3.2 |
| Incidents it suffered (e.g. hacks) | -19.2 |
| Problems around it, caused by others | -0.8 |
| Well known and widely used | +15 |
| Long-running | +4 |
| Sum | 61 |
Score: 61/100 (kept between 0 and 100)
How scoring works →Summary
Ronin Network is an Ethereum sidechain developed by Sky Mavis to support the Axie Infinity play-to-earn game. In March 2022, it suffered the largest cryptocurrency hack in history when attackers — subsequently attributed by the FBI and U.S. Treasury to North Korea's Lazarus Group — exploited compromised validator private keys to drain approximately $625 million in ETH and USDC. A second, smaller exploit occurred in August 2024, though those funds were returned by a white-hat MEV bot operator.
Connected Entities
8 entities · 59 linked investigations- Ronin Bridge→mentioned with→Ethereum(80%)
- Ethereum→mentioned with→Bitcoin(60%)
- Ronin Bridge→mentioned with→Binance(65%)
- Axie Infinity→mentioned with→Binance(70%)
- Binance→mentioned with→Ethereum(65%)
- Axie Infinity→mentioned with→Ronin Bridge(90%)
- Axie Infinity→mentioned with→Ethereum(80%)
- Axie Infinity→mentioned with→Ronin Network(80%)
- North Korea Lazarus Group — H1 2026 Systematic Crypto Theft Campaign→mentioned with→Axie Infinity(80%)
- North Korea Lazarus Group — H1 2026 Systematic Crypto Theft Campaign→mentioned with→Ronin Bridge(80%)
- + 14 more
Timeline(12 events)
November 2021
Sky Mavis temporarily allowlisted to sign transactions on behalf of the Axie DAO validator to manage transaction volume.
December 2021
Temporary delegation program expired, but the Axie DAO validator allowlist entry was never revoked — creating the backdoor later exploited.
23 March 2022
Attackers used compromised Sky Mavis validator keys and the unrevoked Axie DAO RPC backdoor to authorize two fraudulent withdrawals: 173,600 ETH and 25.5 million USDC, totaling approximately $625 million.
29 March 2022
Sky Mavis discovered the hack after a user reported inability to withdraw ~5,000 ETH. The breach had gone undetected for six days. Sky Mavis published a public disclosure.
4 April 2022
Lazarus Group begins routing stolen funds through Tornado Cash; the laundering campaign via the mixer would continue through May 19, 2022, processing approximately $455 million.
6 April 2022
Sky Mavis announced a $150 million fundraising round led by Binance (with a16z, Paradigm, Accel, Dialectic) to reimburse hack victims.
14 April 2022
FBI and U.S. Treasury formally attributed the Ronin hack to Lazarus Group and APT38, linked to the Democratic People's Republic of Korea. OFAC added Lazarus-controlled wallet addresses to its sanctions list.
6 May 2022
OFAC sanctioned cryptocurrency mixer Blender.io for processing $20.5 million in Ronin hack proceeds — the first-ever U.S. sanctions on a crypto mixer.
28 June 2022
Ronin bridge relaunched following audits by Verichains and CertiK, with upgraded validator count (11 nodes), raised threshold (10-of-11 signatures), and a new circuit-breaker system.
12 August 2022
OFAC sanctioned Tornado Cash, citing its role in laundering over $455 million in Ronin hack proceeds among other illicit funds.
8 September 2022
Chainalysis and law enforcement announced the first-ever seizure of cryptocurrency stolen by a North Korean hacking group: approximately $30 million recovered from Ronin hack proceeds.
6 August 2024
Ronin bridge suffered a second exploit: approximately $12 million (4,000 ETH and 2 million USDC) extracted via a smart contract initialization bug. An MEV bot frontran the attacker and returned all funds, receiving a $500,000 white-hat bounty.
Decision Log
- slot 455368778 · hash GNbUT3qEw5Wpku86P1zWiaCi5MtQVazkQBQhaNwA1oVc
- slot 423210478 · hash 2DPSbkDxUDEX8c6De2iSsgPUL9Cw5UBiN2qYdyK2VeMn
This investigation is cryptographically anchored to the Solana blockchain (2 decisions). 22 of 23 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 5/30/2026, 6:25:40 PM
last updated: 10/10/2026, 6:48:49 PM
5 viewsavoid.net — verified advice for a post-truth world