Yesterday, a high-profile security incident occurred on the Ronin Network blockchain in cyberspace. White hat hackers exploited a vulnerability in the Ronin bridge, managing to withdraw 4,000 ETH and 2 million USDC, totaling $12 million. This amount was the maximum that could be withdrawn in a single transaction, potentially preventing a larger theft.
The hackers promptly informed the Ronin Network team about the vulnerability they had exploited during their attack. Following the fund withdrawal, the bridge’s operations were halted for 40 minutes.
While a detailed analysis of the incident will be released next week, Ronin has revealed that the exploit was caused by a recent bridge update deployed through a control process that bypassed the security system.
An error in the bridge’s system interpretation of the operators’ votes threshold led to unauthorized individuals being able to carry out malicious actions. The Ronin Network team is currently addressing this root cause and will conduct thorough checks on all future corrections before implementation. The bridge will remain suspended until intensive security checks are completed before it is relaunched.
Additionally, the current bridge structure will be replaced by a new solution developed in collaboration with Ronin validators. The white hat hackers who returned the stolen funds will receive a $500,000 reward for their efforts in auditing the system’s security.
Earlier assurances from the Ronin platform stated that all user funds would be secure and fully reimbursed, regardless of the hackers’ actions. This incident is not the first time the Ronin Network bridge has been targeted; in March 2022, the North Korean Lazarus group conducted a massive theft totaling $625 million.
While Lazarus did not return the stolen funds, law enforcement agencies managed to recover approximately $30 million in September 2022 and an additional $5.8 million in February 2023.