{"meta":{"database":"Global Social Engineering Impact Database","url":"https://global-social-engineering-impact-da.vercel.app","license":"CC BY 4.0 — attribute to Netarx Social Engineering Incident Database","generated":"2026-08-29T09:22:37.395Z","total":1,"returned":1,"limit":50,"offset":0,"next":null,"note":"Read loss_kind before summing loss_usd: only direct_loss and ransom_paid are comparable. Entries with entry_type \"benchmark\" are aggregate agency statistics and overlap with everything else by construction."},"results":[{"title":"Ronin Bridge crypto theft caused by a fake LinkedIn job offer PDF","date":"2022-03-23","date_precision":"day","victim_org":"Sky Mavis (Ronin Network / Axie Infinity)","sector":"Cryptocurrency","country":"Vietnam","primary_vector":"Fake Job Offer / Recruitment Lure","secondary_vectors":["Spear Phishing (Email)"],"ai_involvement":"No AI reported","ai_notes":"No AI element reported; the recruiter persona and interview process were run by humans.","outcomes":["Cryptocurrency Theft"],"loss_usd":620000000,"loss_note":"173,600 ETH and 25.5 million USDC were drained; the value is commonly reported as roughly $540 million at the time of the hack and about $620-625 million at the time of disclosure, depending on the valuation date.","records_affected":null,"threat_actor":"Lazarus Group (North Korea); sanctioned by the US Treasury in April 2022","summary":"On 23 March 2022 attackers drained the Ronin bridge that underpinned the Axie Infinity game, in one of the largest cryptocurrency thefts on record; the loss was noticed only six days later. Reporting by The Block and others established that a senior Sky Mavis engineer had been approached on LinkedIn by fake recruiters, taken through several rounds of interviews, and sent an offer document as a PDF whose opening installed spyware.","how_it_worked":"Attackers posing as a non-existent company recruited a senior engineer over LinkedIn with an unusually generous compensation package, running a plausible multi-round interview process to build credibility. The final offer arrived as a PDF; downloading and opening it on a company machine executed spyware that gave the attackers a foothold in Sky Mavis systems. From there they obtained the private keys for four of the nine Ronin validator nodes, and used a still-active allowlist permission previously granted by Sky Mavis to the Axie DAO to obtain a fifth signature, reaching the five-of-nine threshold needed to authorise withdrawals from the bridge.","lessons":"Validator key material should live in hardware security modules on isolated machines that never render untrusted documents, and delegated signing permissions must expire automatically rather than persist after a temporary need ends.","confidence":"Confirmed","sources":[{"title":"How a fake job offer took down the world's most popular crypto game","url":"https://www.theblock.co/post/156038/how-a-fake-job-offer-took-down-the-worlds-most-popular-crypto-game","publisher":"The Block"},{"title":"Hackers Used Fake Job Offer to Hack and Steal $540 Million from Axie Infinity","url":"https://thehackernews.com/2022/07/hackers-used-fake-job-offer-to-hack-and.html","publisher":"The Hacker News"},{"title":"Spear Phishing Fake Job Offer Likely Behind Axie Infinity's Lazarus $600m Hack","url":"https://www.infosecurity-magazine.com/news/fake-job-offer-behind-axie/","publisher":"Infosecurity Magazine"},{"title":"Hackers stole $620 million from Axie Infinity via fake job interviews","url":"https://www.bleepingcomputer.com/news/security/hackers-stole-620-million-from-axie-infinity-via-fake-job-interviews/","publisher":"BleepingComputer"}],"entry_type":"incident","slug":"2022-ronin-bridge-crypto-theft-caused-by-a-fake-linkedin-job-offer-pdf","year":2022,"loss_kind":"direct_loss","url":"https://global-social-engineering-impact-da.vercel.app/incidents/2022-ronin-bridge-crypto-theft-caused-by-a-fake-linkedin-job-offer-pdf"}]}