Treasury Sanctions North Korean Hacker Group, Confirms Ties to $625M Theft

Hackers stole $625 million last month from the Ronin Network, a sidechain used for play-to-earn game Axie Infinity


Blockworks Exclusive art by axel rangel


key takeaways

  • US Treasury department alleges that North Korea-based Lazarus Group is behind the theft
  • Ronin is still in the process of recovering funds, it said

The Office of Foreign Assets Control has sanctioned Lazarus Group, the North Korea-based hacker the US Department of the Treasury claims is responsible for the $625 million Ronin Bridge hack in March. 

On Thursday, the Treasury department announced that the ethereum address, which wallet profiler Nansen has labeled “Ronin Bridge Exploiter,” allegedly behind the hack was added to the Specially Designated Nationals And Blocked Persons List (SDN). 

Ronin Network, an Ethereum-linked sidechain used for blockchain gaming group Axie Infinity, was breached in late March for roughly $600 million, or 173,600 ether, and $25.5 million USDC. 

At time of publication, the wallet address holds $445.3 million, according to Etherscan. The hackers have been moving funds around since the breach occurred, data shows. 

The exploiter used hacked private keys to forge withdrawals on March 23, according to a statement from Ronin at the time. The breach was discovered nearly a week after the hack when a user was unable to withdraw 5,000 ETH.

The hackers tried to sell about 6,500 stolen ETH in March, transferring the tokens to three different exchanges, according to William Quigley, co-founder of stablecoin Tether and non-fungible token (NFT) blockchain platform WAX. All of the stolen USDC was transferred out to various wallets and DeFi protocols, Etherscan data shows.

Earlier this month, Sky Mavis, the company behind the Ronin Network bridge, announced it had raised $150 million to help reimburse affected users. And in a blog post, Axie Infinity admitted it had “made some trade-offs” that enabled the hack to take place. 

Data shows that more than 3,000 ETH, or about $9.9 million, was moved from the wallet Wednesday into another address that then transferred the ETH in increments of 100 to several different wallets. 

“We are still in the process of adding additional security measures before redeploying the Ronin Bridge to mitigate future risk,” representatives from Ronin wrote in a community update post on Thursday. “Expect the bridge to be deployed by end of month.”

Start your day with top crypto insights from David Canellis and Katherine Ross. Subscribe to the Empire newsletter.

Explore the growing intersection between crypto, macroeconomics, policy and finance with Ben Strack, Casey Wagner and Felix Jauvin. Subscribe to the On the Margin newsletter.

The Lightspeed newsletter is all things Solana, in your inbox, every day. Subscribe to daily Solana news from Jack Kubinec and Jeff Albus.


Upcoming Events

Salt Lake City, UT

MON - TUES, OCT. 7 - 8, 2024

Blockworks and Bankless in collaboration with buidlbox are excited to announce the second installment of the Permissionless Hackathon – taking place October 7-8 in Salt Lake City, Utah. We’ve partnered with buidlbox to bring together the brightest minds in crypto for […]

Salt Lake City, UT

WED - FRI, OCTOBER 9 - 11, 2024

Pack your bags, anon — we’re heading west! Join us in the beautiful Salt Lake City for the third installment of Permissionless. Come for the alpha, stay for the fresh air. Permissionless III promises unforgettable panels, killer networking opportunities, and mountains […]

recent research

Unlocked by Template.png


With the spot ETH ETF approval, the institutions are coming. stETH - given its dominance in marketshare, existing liquid market structures, and highly desirable properties - is poised for institutions.


Launching cryptocurrencies the old fashioned way may soon make a return


Kraken and CertiK brought their beef to social media after Kraken said researchers exploited $3 million through a bug


NVIDIA’s historic run is only deepening the divide between mega-cap tech stocks and the rest of the market.


EIP-7702 was quickly adopted for the next Ethereum upgrade, but developers haven’t quite locked it down