Norwegian government freezes and returns $5.7 million connected to Ronin hack

The Norwegian government has frozen and returned $5.7 million in funds connected to the $600 million Ronin RON -2.22% exploit in 2022.

Ronin is an Ethereum sidechain built to support the play-to-earn web3 game Axie Infinity AXS -1.81% , created by developers Sky Mavis.

“The Norwegian National Authority for Investigation and Prosecution of Economic and Environmental Crime (Økokrim) has successfully frozen and returned 5.7 M USD in stolen assets from the Ronin bridge incident,” Sky Mavis posted to X on Friday. 

The Axie Infinity web3 game creator said it required a coordinated effort among law enforcement agencies, lawyers, accountants and blockchain forensics firms like Chainalysis to recover the assets. 15% of the funds will be used to cover expenses, with the remainder deposited to the Axie Infinity treasury, it confirmed.

“We'd like to publicly extend our heartfelt gratitude to everyone who assisted in the recovery efforts, especially Økokrim and the FBI in the US, for their tireless effort to track down and recover these assets for the Axie and Ronin communities,” Sky Mavis added.

The game developer reiterated that around $40 million in separate assets have been frozen by law enforcement authorities so far, but that these would take some time to recover and it was unable to provide a specific timetable for their return at this stage.

Ronin’s $600 million exploit

The Ronin exploit in March 2022 remains the largest DeFi exploit in history, according to The Block’s data dashboard, resulting in the loss of more than $600 million in crypto assets. The attack has been tied to North Korea's Lazarus Group alongside other hacks such as the $100 million Harmony bridge exploit in January 2023.

The exploit resulted in the loss of 173,600 ETH (worth roughly $590 million at the time) and $25.5 million worth of the stablecoin USDC. 

Specifically, five out of nine validator private keys on the Ronin network were compromised during the incident. Once those validators were controlled, the attacker gained the ability to authorize and execute fraudulent transactions to drain funds from the Ronin bridge, which is used to transfer assets between the Ronin sidechain and the Ethereum mainnet.