ALT-52 · Analysis · 23 Oct 2026
The Ronin bridge: five keys out of nine
A blockchain bridge required five of nine validator signatures. Attackers obtained five and withdrew more than $600 million — and nobody noticed for six days. A study of thresholds that weren't.
- Nov 2021The Axie DAO allows Sky Mavis to sign on its behalf to handle load; the permission is never removed.
- 23 Mar 2022Two withdrawals drain the bridge.
- 29 Mar 2022A user cannot withdraw funds; the theft is discovered.
- 14 Apr 2022The FBI attributes the theft to Lazarus Group.
- Validator signatures required — and obtained
- 5 of 9Ronin Network
- Between the theft and its discovery
- 6 daysRonin Network
What failed
A multi-signature threshold only protects if the keys are independent. Here, one organisation effectively controlled five — the threshold. Nothing watched outflows, so a drain of the bridge's funds went unseen for days.
Our reading
Analysis — Altumptic's interpretation of the sources below.
- Count independent key holders, not keys.
- Temporary permissions need an expiry date enforced by code.
- Monitoring of outflows is as important as signing rules.
What to do
- Distribute signing keys across organisations and infrastructure that do not share failure modes.
- Alert on unusual withdrawals in real time and add rate limits.
- Review and revoke delegated signing rights on a schedule.
Sources
- Ronin — Community alert: Ronin validators compromised (29 Mar 2022, archived)
- FBI — Statement on attribution of malicious cyber activity posed by the DPRK (14 Apr 2022)
Altumptic has no involvement in these incidents and no non-public information about them. Figures are as reported by the sources above on the dates given.
Cite this entry
Altumptic Lab (2026). ALT-52 — The Ronin bridge: five keys out of nine. 23 Oct 2026. altumptic.com/research/ronin-bridge-2022