Beyond the Contract, Part 1 : The Hack That Didn’t Exploit a Smart-Contract Bug

Case study of the Ronin Network hack and the theft of 173,600 ETH and 25.5M USDC roughly $540 million at the moment of the attack

Alix40 avatar
Alix40
4 min read
Beyond the Contract, Part 1 : The Hack That Didn’t Exploit a Smart-Contract Bug featured image

In Web3, we obsess over smart contract security—audits, bounties, line-by-line code reviews. That’s essential, but it can also create a dangerous blind spot. We’re so focused on the fortress walls that we forget to lock the front door.

What if one of the biggest DeFi heists didn’t involve a smart-contract bug at all?

That’s the story of the Ronin Network and the theft of 173,600 ETH and 25.5M USDC—roughly $540M at the moment of the attack on March 23, 2022, and about $615–$625M by the time it was disclosed on March 29, 2022. The lesson: a project’s biggest vulnerability often isn’t in its code, but in its people and processes. Reuters

The Case Study: A Job Offer Too Good to Be True

The attack has been attributed by the U.S. Treasury to North Korea’s Lazarus Group. According to Sky Mavis’s own post‑mortem, one employee was compromised via spear‑phishing, which enabled the attackers to reach internal systems. Multiple outlets reported that the initial lure was a fake LinkedIn job offer containing a malware‑laced PDF sent to an engineer—an example of social engineering, not a blockchain bug.
Sources: Sky Mavis post‑mortem, U.S. Treasury, The Block, The Hacker News

The Story

  • Timeline: The breach occurred March 23, 2022 and was discovered March 29, 2022.
  • Entry: A Sky Mavis employee was spear‑phished; the intruders then used that access to pivot through internal systems.
  • Attribution: U.S. authorities later linked the operation to the Lazarus Group.

Sources: Post‑mortem, U.S. Treasury

The Technical Vector (What Actually Happened)

Ronin used a proof‑of‑authority design in which a small set of validators authorize bridge withdrawals. At the time, 9 validators existed and 5 signatures were required to move funds from the bridge.

  • The attackers gained control of 4 Sky Mavis validator keys.
  • For the fifth signature, they didn’t find a stray key on a forgotten server. Instead, they abused an unrevoked allowlist from November 2021: during a period of explosive growth, the Axie DAO validator had allowlisted Sky Mavis to sign on its behalf to support gas‑free transactions. Although that program ended in December 2021, the allowlist wasn’t revoked.
  • Using a gas‑free RPC backdoor tied to that allowlist, the attackers obtained the Axie DAO validator’s signature, giving them 5 of 9 approvals.
  • They then executed two bridge‑withdrawal transactions draining 173,600 ETH and 25.5M USDC.

Sources: Post‑mortem (validator design, allowlist, gas‑free RPC, two transactions)

Bottom line: No base‑layer cryptography was broken and no smart‑contract bug was exploited. The attackers used valid signatures obtained through compromised systems and lingering authorization.

How Full‑Stack Security Could Have Prevented This

Let’s be clear: no smart‑contract audit alone would have stopped this. This was an operational and infrastructure failure.

At Valkyri Sec, we take a full‑stack view. Here’s how defenses map to this exact kill chain:

1) Human‑Layer Security

  • Targeted spear‑phishing simulations for engineers and ops.
  • Document detonation/sandboxing for all external PDFs and office files.
  • Least‑privilege SSO with device posture checks; work‑only, hardened endpoints.
  • Clear playbooks for unsolicited recruiter outreach and file handling.
    Source: post‑mortem confirms spear‑phishing of an employee.

2) Zero‑Trust Architecture

  • Assume any device could be compromised. Segment critical signing infrastructure onto isolated networks/VPCs and separate identity domains.
  • MFA + device posture + just‑in‑time (JIT) access for any action that can touch validators or bridge backends.
  • Human‑in‑the‑loop approvals and withdrawal thresholds for large bridge transactions.

3) Key Management & Authorization Governance

  • Store validator/bridge keys in HSMs or MPC wallets with policy‑based approvals (per‑tx limits, rate‑limits, geo/IP restrictions).
  • Treat allowlists and backdoors as high‑risk: apply automated expiry, change management, and continuous reconciliation to ensure temporary permissions are revoked.
  • Comprehensive logging and real‑time alerting for any access attempt to key material or signing endpoints.
  • Anomaly detection on bridge flows and automatic pause switches for unusual withdrawal patterns.

4) Monitoring & Response

  • Large‑outflow detectors with on‑call escalation (the post‑mortem notes the lack of a proper tracking system delayed discovery).
  • Runbooks for bridge shutdown, withdrawal halts, and incident communications.

Takeaway

Your project isn’t just code on a blockchain; it’s a living system of people, cloud services, front‑ends, and privileged infrastructure. Securing the contract is only step one.

References & Further Reading