Lazarus hackers used a fake LinkedIn job offer to plant spyware on a Sky Mavis engineer's laptop, then drained $540M from the Ronin bridge in March 2022.
Social Engineering Examples·13 sources
In March 2022, North Korea's Lazarus Group stole 173,600 ETH and 25.5 million USDC from the Ronin bridge behind the game Axie Infinity, worth about $540 million when it left. The way in was a fake job. A senior engineer at Sky Mavis, Ronin's operator, went through several rounds of interviews for a role at a company that didn't exist, then opened a generous "offer" document that installed spyware. Nobody noticed the theft for six days. Status: Documented incident, attributed by the US Treasury and FBI.
The attackers posed as recruiters from a made-up company and contacted Sky Mavis staff on LinkedIn. One senior engineer went through several interview rounds, which built trust, before receiving what was described as an "extremely generous" job offer document. Opening it on a work device installed spyware. Reporting by The Block, backed by Sky Mavis's own post-mortem, established this route.
Tip: a job offer is still a file from a stranger. Never open hiring documents on a device that can reach production systems or keys.
| Step | What happened |
|---|---|
| Foothold | Spyware on the engineer's work device |
| Spread | Moved through Sky Mavis's internal systems |
| Four keys | Took private keys for four of the nine Ronin validators Sky Mavis ran |
| Fifth signature | Used an old arrangement: in November 2021 the Axie DAO let Sky Mavis sign on its behalf during a rush of new players. It ended in December but was never revoked |
| Drain | Signed two fraudulent withdrawals on 23 March 2022 |
| Discovery | On 29 March, a user couldn't withdraw 5,000 ETH and found the bridge short |
The withdrawals had valid signatures, and there was no monitoring or limit on large withdrawals, so nothing raised an alarm.
| Item | Amount |
|---|---|
| Stolen (on-chain) | 173,600 ETH and 25.5 million USDC |
| Value when taken | About $540 million (Elliptic) |
| Value when discovered | Over $615 million (Elliptic); CoinDesk said $625 million |
| Seized, September 2022 | Over $30 million, the first seizure of crypto stolen by a North Korean group |
| Seized by Norway, February 2023 | NOK 60 million, returned to Ronin in June 2024 |
Sky Mavis reimbursed users from its reserves and a $150 million funding round led by Binance. The bridge reopened in June 2022 with more validators, daily withdrawal limits and human review for large withdrawals.
On 14 April 2022, the US Treasury added the attacker's Ethereum address to its sanctions list and, with the FBI, attributed the theft to Lazarus Group. Much of the money was laundered through the Tornado Cash mixer, which Treasury sanctioned in August 2022 and removed from the list in March 2025. The same fake-job method hit CoinsPaid in 2023, which says it lost $37.3 million after an engineer sat a fake Crypto.com interview. See also Contagious Interview.
See also recruitment fraud and spear phishing.
A Sky Mavis engineer opened a fake job offer that installed spyware. The attackers then got enough validator keys to sign withdrawals from the bridge.
173,600 ETH and 25.5 million USDC, worth about $540 million at the time and over $615 million when it was discovered.
The US Treasury and FBI attributed it to North Korea's Lazarus Group.
Yes. Sky Mavis reimbursed users using its reserves and a $150 million funding round led by Binance.
Social Engineering Examples. “Axie Infinity Ronin bridge heist: the fake LinkedIn job offer that cost ~$540M (2022)”. Accessed 3 November 2026. https://socialengineeringexamples.com/axie-infinity-ronin-bridge-linkedin-job-offer-heist-2022
Lazarus operators are documented (per Sky Mavis's own postmortem and subsequent reporting) as researching Sky Mavis staff, likely via LinkedIn and other public professional-networking data, to identify engineers plausibly holding privileged access to Ronin's validator infrastructure.
employee-facing OSINT exposure on LinkedIn (names, roles, org structure) is very hard to eliminate at enterprise scale; the realistic control assumes attackers already have this and hardens the hiring process it later gets used against, rather than trying to suppress public profiles.
the operators built out a fake recruiting identity, a company that did not exist, complete with enough of a plausible corporate veneer to survive a target's cursory checks during outreach.
independently verify any unfamiliar prospective employer before engaging further, checking for a registered business entity, real and checkable staff, and a corroborated public footprint beyond a LinkedIn page.
posing as recruiters, the attackers approached multiple Sky Mavis employees on LinkedIn and encouraged them to apply; one senior engineer was taken through several rounds of fake interviews designed to build trust and a sense of reciprocity before the payload was introduced.
treat unsolicited recruiter outreach that escalates unusually fast toward a "too good to be true" offer as a red flag, reinforced by ongoing social-engineering awareness training that specifically covers the fake-job-offer pattern.
the operators sent the engineer an "extremely generous" job-offer document, reported as a PDF or Word file, engineered to carry spyware that would execute when opened.
file-borne payloads delivered through personal channels like LinkedIn DMs largely bypass corporate email security controls, so this stage has no strong standalone defense; the practical control sits at Stage 5, restricting where such files can ever be opened.
the engineer opened the offer file on a corporate device, the spyware installed, and the attackers gained a foothold on a Sky Mavis workstation.
require that any recruiting or hiring-related attachment be opened only in an isolated, sandboxed, non-privileged environment (for example a disposable VM or non-corporate device), never on a workstation with access to production systems or key material.
from that compromised workstation the attackers moved through Sky Mavis's internal systems and obtained the private keys for four of the nine Ronin validator nodes Sky Mavis directly controlled, one short of the five-of-nine signature quorum needed to move funds.
apply network segmentation and least-privilege access so that compromising a single end-user workstation cannot reach validator keys or other sensitive infrastructure; require separate, hardware-backed authentication for systems with signing authority.
the attackers exploited an unrelated operational gap, an Axie DAO allowlist granted to Sky Mavis in November 2021 for a gas-free RPC arrangement that was never revoked after the underlying need ended in December 2021, to obtain the fifth validator signature without compromising the Axie DAO's own key.
audit delegated permissions and allowlists on a recurring schedule and expire them automatically when the underlying business need ends, and require genuine independent multi-party key custody across separate organizations so no single company's compromise can reach quorum.
with five of nine signatures in hand, the attackers forged and submitted two fraudulent withdrawal transactions, draining 173,600 ETH and 25.5 million USDC from the Ronin bridge; because no withdrawal-limit or anomaly-monitoring controls existed, the theft went undetected for six days.
enforce withdrawal limits, tiered signature thresholds with mandatory human review above set value thresholds, and real-time anomaly monitoring on high-value transaction systems so a fraudulent drain is flagged within minutes rather than sitting undetected for days.
the stolen assets were moved through decentralized exchanges to avoid centralized AML/KYC checks, then substantially funneled through the Tornado Cash mixer (with some early attempts at centralized exchanges), converting the on-chain theft into usable proceeds consistent with reported DPRK state revenue-generation objectives.
the controls that actually clawed money back here were blockchain-forensics tracing and interdiction at the point where funds reached exchanges, which recovered over $30M in September 2022 and NOK 60 million through Norway's Okokrim. Mixer designation is a weaker lever to plan around: OFAC sanctioned Tornado Cash in August 2022 and removed it from the SDN list in March 2025. A well-resourced nation-state actor still moves most of the funds before any interdiction lands.
Browse by what this case has in common with others in the library.
A Lapsus$ affiliate used a contractor's stolen Uber password, likely bought on the dark web, flooded them with MFA push…
Fake finance "directors" in WhatsApp groups steered 18+ US investors to NanoBit, a crypto platform that never traded. The SEC…
A fake IT text and phone call got a Retool employee's MFA codes in 2023. Google Authenticator sync did the…
A fraudster spoofed Wells Fargo's real 800 number nine minutes after a legitimate advisor call, phished a 2FA code from…
A Chinese national entered Mar-a-Lago after a pool-visit pretext and staff's unverified assumption that she was related to a member.…
An Atlantic City woman called grieving widows posing as a life insurer, demanding gift cards to clear policy "arrears". 17+…
A respected Kansas bank CEO was groomed on WhatsApp into a crypto scam, wired $47.1M of bank funds in 11…
Colombian police say 'Los Cyber' posed as bank fraud staff, got victims to share their phone screens and took COP…
A 12-person ring watched hacked inboxes for big payments, then redirected them with fake emails. Trial evidence put losses above…
A caller posing as Standard Bank got an 18-year-old to move her R438,900 education fund to a 'safe' account in…
A four-man Manhattan BEC ring used compromised business email accounts to redirect approximately $3.49 million and $2.0 million in wires,…
Two New Jersey men ran US "laptop farms" and shell companies that let North Korean IT workers use the stolen…
KnowBe4 hired a North Korean operative using a stolen US identity and an AI-enhanced photo in 2024. Malware started on…
A compromised Constant Contact mass-mailing account let Russia-linked Nobelium (APT29) send USAID-spoofed phishing emails that funneled roughly 3,000-7,000 accounts across…
Russian GRU officers spoofed Google security-alert emails with Bitly-masked links to phish 300+ individuals affiliated with the Clinton campaign, DCCC,…
North Korea-linked attackers phished Sony staff with fake Apple ID emails, stole data and wiped thousands of PCs in 2014.…
North Korea-linked hackers ran fake job interviews for crypto firms, then told applicants to paste a 'camera fix' that installed…
Social Engineering Examples