Ronin Bridge Hack
What happened
A faulty Ronin Bridge upgrade left the bridge's operator-weight state uninitialized, allowing unauthorized Ethereum-side withdrawals. An MEV bot executed the withdrawals, after which the assets were returned and the bridge was paused.
Unsafe upgrade initialization. A storage value moved into _totalOperatorWeight required initialization by initializeV3, but the upgrade procedure skipped it. Zero total weight caused the bridge's required-vote calculation to return zero, disabling the signature-weight safeguard for withdrawals.
How it happened
Ronin upgraded its bridge proxy from version 2 to version 4 but executed initializeV4 without first running initializeV3. The skipped initializer left _totalOperatorWeight at zero. As a result, the computed minimumVoteWeight was also zero, so the withdrawal-verification check could pass without the normal bridge-operator approval threshold.
An MEV bot front-ran manual exploitation attempts and withdrew 3,996 ETH and 1,998,046 USDC from the Ethereum-side bridge. The bot returned the assets, subject to a reported whitehat bounty. The incident is distinct from the 2022 Ronin validator-key compromise.
Protocol details
Funds Recovery
Recovered
$12.0M
Net Loss
$0
Evidence
- report @Ronin_Network incident report x.com
- report @De_FiSecurity incident report x.com
- report Ronin Bridge Incident Statement x.com
- transaction Ronin ETH Withdrawal Transaction etherscan.io
- analysis DeFiLlama defillama.com
- analysis Ronin Bridge Paused and Restarted After Whitehat Hack coindesk.com
- analysis Ronin Bridge Attack Analysis threesigma.xyz
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
