CSIS entry 355 · April 2022
The U.S. Treasury Department’s Office of Foreign Assets Control attributed the March 29 hack of Ronin Network to a North Korean hacking group and announced sanctions against the hackers. The group stole over $540 million in Ethereum and USDC.
A hacker stole $625 million from the blockchain behind NFT game Axie Infinity · 2022-03
A hacker stole $625 million from the blockchain behind NFT game Axie Infinity
https://www.theverge.com/2022/3/29/23001620/sky-mavis-axie-infinity-ronin-blockchain-validation-defi-hack-nft
https://www.cisa.gov/uscert/ncas/alerts/aa22-108a
Targeting of Axie Infinity’s Ronin Network · Apr 2022
video game. The hackers infiltrated Ronin Network, a decentralized finance platform used to earn and pay for in-game items with cryptocurrency. Lazarus then used a cryptocurrency mixer, Tornado Cash, to launder a portion of the stolen funds to avoid tracing and asset freezes. In response, the U.S. Treasury’s Office of Foreign Assets Control implemented sanctions against the Lazarus Group.
Axie Infinity Hack (Ronin Hack) · March
Annex 76: List of DPRK cyberthreat actors' malicious activities in 2022 monitored by the Panel. RGB Unit: Lazarus Group; Case Name: Axie Infinity Hack (Ronin Hack); VAS √; VAS Value: 173,600 ETH 25.5 mil. USD Coin; Publicized Month: March. (SPH Significant Phishing, KAC knowledge acquisition and espionage, VAS virtual asset seizures)
Sky Mavis/Ronin · 23 March 2022
Annex 95: Suspected DPRK cyberattacks on cryptocurrency-related companies (2017-2023) investigated by the Panel. Table 2022: Victim: Sky Mavis/Ronin; Date: 23 March; Amount (USD equivalent): 620m; Location: Vietnam / Singapore
Ronin (theft of Ethereum reported March 29) · reported on March 29
Through our investigation we were able to confirm Lazarus Group and APT38, cyber actors associated with the DPRK, are responsible for the theft of $620 million in Ethereum reported on March 29.
Ronin Network · 2022-03-29
Description of the event: Axie Infinity sidechain Ronin Network issued a community alert today. Ronin Network experienced a security breach. Ronin bridge 17.36w ETH and 25.5M USDC were stolen, with a loss of more than 610 million US dollars. As stated by the Ronin developers, the attacker used the hacked private key to forge fake withdrawals, pulling funds out of the Ronin bridge in just two transactions. It is reported that this incident is suspected to be related to the North Korean hacker group Lazarus Group. | Amount of loss: $ 610,000,000 | Reference: https://roninblockchain.substack.com/p/community-alert-ronin-validators?s=w
18th April – Threat Intelligence Report · 2022-04-18
North Korean state-sponsored APT group Lazarus has been linked to a recent theft of $625 million worth in Ethereum cryptocurrency in the Axie Infinity game.
Theft from foreign-based COMPANY-2 · in or around March 2022
Next, in or around March 2022, North Korean cyber actors stole approximately $615 million in virtual currency from foreign- based COMPANY-2. [Case No. 1:24-cv-02826, U.S. District Court for the District of Columbia; filing: COMPLAINT against BITCOIN AND BTC.B SEIZED FROM EIGHT TRANSACTION HASHES AT CRYPTOCURRENCY BRIDGE-1]
Sky Mavis (Axie Infinity) theft · March 2022
In March 2022, North Korean hackers stole over $600 million in virtual currency from Sky Mavis, the company behind Axie Infinity, a popular blockchain-based play-to-earn video game. [Case No. 2:24-cv-04640, U.S. District Court for the Central District of California; filing: COMPLAINT No Fee Required - US Government, filed by plaintiff UNITED STATES OF AMERICA.]
Sky Mavis theft · in or around March 2022
Then, in or around March 2022, North Korean cyber actors stole approximately $615 million in virtual currency from foreign- based Sky Mavis. [Case No. 1:25-cv-03771, U.S. District Court for the District of Columbia; filing: COMPLAINT against APPROXIMATELY 1,159,834.52 USDT]
Sky Mavis theft · in or around March 2022
Then, in or around March 2022, APT38 cyber actors stole approximately $615 million in virtual currency from foreign-based Sky Mavis. [Case No. 1:25-cv-03943, U.S. District Court for the District of Columbia; filing: COMPLAINT against APPROXIMATELY 13.98 MILLION USDT]
Ronin Network theft, March 2022 · May 9, 2023 (as shown on page)
Two weeks after Ronin's announcement, the US Treasury's Office of Foreign Assets Control (OFAC) announced new sanctions against the thief's Ethereum address and listed the owner of this address as the Lazarus Group – a North Korean state hacking organization.
Ronin hack: Lazarus behind theft · May 9, 2023 (as shown on page)
It later emerged that the Lazarus Group North Korean cybercrime outfit was behind the theft.
Ronin Network bridge theft; $30 million seized · published 2022-09-08
The attack began when the Lazarus Group gained access to five of the nine private keys held by transaction validators for Ronin Network's cross-chain bridge.
Ronin bridge hack · published 2022-04-15 (March 2022 hack)
The FBI announced later the same day that it was, "able to confirm Lazarus Group and APT38, cyber actors associated with the DPRK, are responsible for the theft of $620 million in Ethereum reported on March 29."
Ronin bridge exploit · published 2023-09-13 (2022 exploit)
Since the $650 million exploit of the Ronin bridge in 2022, attention has been on North Korea's Lazarus Group.
Ronin Network (Axie Infinity) sidechain API hack, Q1 2022 · published 2022-05-18
Headlined by the API hack of Axie Infinity's Ronin Network sidechain in March, which resulted in North Korean-linked hackers looting a record $615 million of user funds from the gaming platform
Theft of $620 million in Ethereum (statement does not name the victim) · reported on March 29 (2022)
Through our investigation we were able to confirm Lazarus Group and APT38, cyber actors associated with the DPRK, are responsible for the theft of $620 million in Ethereum reported on March 29.
Axie Infinity (Ronin) heist; Blender.io laundering · March 23, 2022
On March 23, 2022, Lazarus Group, a DPRK state-sponsored cyber hacking group, carried out the largest virtual currency heist to date, worth almost $620 million, from a blockchain project linked to the online game Axie Infinity; Blender was used in processing over $20.5 million of the illicit proceeds.
OFAC attribution of Axie Infinity heist to Lazarus Group · April 14, 2022
This builds upon OFAC's April 14, 2022, attribution of DPRK's Lazarus Group as the perpetrators of the Axie Infinity heist and identification of the original getaway wallet address.
США обвинили северокорейскую хакерскую группировку во взломе мобильной игры Axie Infinity · 2022-04-15
attribution sentence(s): Министерство финансов США обвиняет северокорейскую хакерскую группу Lazarus в краже $625 млн в криптовалюте из сети Ronin, блокчейна, поддерживающего криптоигру Axie Infinity. | Его отнесли к группе Lazarus, сообщает Vice. | Lazarus Group — группа киберпреступников, известная своими связями в Северной Корее.
Ronin network (Axie Infinity) · late March 2022 (breached 23 March, discovered 29 March)
Para 147: “In late March 2022, the Ronin network, an Ethereum (ETH)-based sidechain used for the non-fungible token (NFT game) Axie Infinity, was hacked for over 173,600 ETH and 25.5 million USD Coin. Newsletters from the network reported that the hackers accessed five out of nine private key validator nodes ... In mid-April, the Federal Bureau of Investigation of the United States of America attributed the Ronin hack to the Lazarus Group ...” Footnote 128: “The Ronin network was breached on 23 March, and the breach was discovered on 29 March.”
Axie Infinity hack · March 2022
(MSMT/2025/2, report p. 50) “Cambodia-based DPRK actors also helped launder funds from the Axie Infinity hack, which resulted in the loss of over $600 million in cryptocurrency from Vietnamese company Axie Infinity in March 2022.”