Battle-hardened Ronin bridge to Axie reopens following $600M hack

Published at: June 29, 2022

Sky Mavis, developers of the popular play-to-earn (P2E) nonfungible token (NFT) game Axie Infinity have announced that the Ronin bridge is back online three months after it was hacked for more than $600 million.

The Ronin bridge is an Ethereum sidechain built for Axie Infinity, and it enables users to transfer assets between the sidechain and the Ethereum mainnet.

On March 29, 173,600 Ether (ETH) and 25.5 million USD Coin (USDC) was drained from the bridge after hackers managed to gain access to private validator keys. The hack was worth more than $620 million at the time.

According to the Tuesday announcement from the Sky Mavis team, the Ronin bridge is back online after three audits (one internal, two external), a new design and full compensation of users’ stolen assets:

“All wETH and USDC owned by Ronin Network users is now fully backed 1:1 by ETH and USDC on Ethereum, as promised. All users’ have been made whole.”

In total, Sky Mavis has now reimbursed 117,600 ETH and 25.5 million USDC by providing the ETH liquidity to back users’ Wrapped ETH (wETH) on the Ronin network.

In April, around 46,000 of that ETH had already been compensated after Binance provided a bridge to its exchange so that users could swap out wETH for ETH. Liquidity was sourced from the Axie Infinity balance and founders’ funds to support the move. Binance also led a $150 million funding round to help Sky Mavis repay Axie Infinity users.

The remaining 56,000 of the total stolen ETH belongs to the Axie DAO Treasury and will remain uncollateralized as Sky Mavis “works with law enforcement to recover the funds.”

good job.

— CZ Binance (@cz_binance) June 28, 2022

As part of the revamped bridge design, Sky Mavis has updated the smart contract software to enable validators to set daily withdrawal limits, with the initial amount set at $50 million at this stage. The team also introduced a circuit breaker system that breaks down the monetary value of withdrawals into three tiers.

Tier 1 is for withdrawals less than $1 million and requires 70% of validators to sign off, and tier 2 is for amounts greater than $1 million and requires 90% of validator signatures. Tier 3 is for withdrawals greater than $10 million and requires a 90% validator sign-off, a small transaction fee and a seven-day review process:

“The new bridge design includes a circuit-breaker system as a contingency plan which increases the security of the bridge by halting large suspicious withdrawals.”

Sky Mavis admitted in a postmortem report in late April that its lack of decentralization had made the Ronin bridge vulnerable to the hack. At the time, it had just nine validator nodes, with employees having access to four of them.

After promptly raising the number of node to 11, Sky Mavis outlined intentions to raise the count to 21 within three months of the postmortem, with the long-term goal of surpassing 100 total nodes.

The team did not provide an update on how many validators nodes the Ronin network now has in the latest announcement, however.

Axie Infinity has seen its monthly NFT sales volume tank dramatically in 2022, with data from CryptoSlam showing that the game went from generating $126.4 million in January to just $2.8 million in June.