What happened
On 23 March 2022 attackers drained the Ronin bridge that underpinned the Axie Infinity game, in one of the largest cryptocurrency thefts on record; the loss was noticed only six days later. Reporting by The Block and others established that a senior Sky Mavis engineer had been approached on LinkedIn by fake recruiters, taken through several rounds of interviews, and sent an offer document as a PDF whose opening installed spyware.
How the deception worked
Attackers posing as a non-existent company recruited a senior engineer over LinkedIn with an unusually generous compensation package, running a plausible multi-round interview process to build credibility. The final offer arrived as a PDF; downloading and opening it on a company machine executed spyware that gave the attackers a foothold in Sky Mavis systems. From there they obtained the private keys for four of the nine Ronin validator nodes, and used a still-active allowlist permission previously granted by Sky Mavis to the Axie DAO to obtain a fifth signature, reaching the five-of-nine threshold needed to authorise withdrawals from the bridge.
AI involvement · No AI reported
No AI element reported; the recruiter persona and interview process were run by humans.
The control that would have caught it· our reading, not a claim from the sources
Validator key material should live in hardware security modules on isolated machines that never render untrusted documents, and delegated signing permissions must expire automatically rather than persist after a temporary need ends.
Sources (4)
- How a fake job offer took down the world's most popular crypto gameThe Block·theblock.coOpen ↗
- Hackers Used Fake Job Offer to Hack and Steal $540 Million from Axie InfinityThe Hacker News·thehackernews.comOpen ↗
- Spear Phishing Fake Job Offer Likely Behind Axie Infinity's Lazarus $600m HackInfosecurity Magazine·infosecurity-magazine.comOpen ↗
- Hackers stole $620 million from Axie Infinity via fake job interviewsBleepingComputer·bleepingcomputer.comOpen ↗
This entry summarises public reporting. It is not a legal finding, and details can change as investigations conclude. Found an error? Send a correction.