Ronin paused bridge after upgrade flaw enabled 4,000 ETH and 2 million USDC withdrawals

Ronin Network paused its Ethereum bridge on August 6, 2024 after a governance-approved upgrade introduced an authorization problem that enabled withdrawals of roughly 4,000 ETH and 2 million USDC. The tokens were returned on August 6, but the incident exposed how a configuration or initialization failure at a cross-chain gateway could bypass the operator-vote threshold meant to protect bridge reserves.

Ronin’s event-day statement said white hats notified the project about a potential exploit. After verifying the report, the team paused the bridge about 40 minutes after the first on-chain action was detected. Contemporaneous transaction records placed the ETH withdrawal at approximately 09:37 UTC, a USDC withdrawal at 10:11 UTC and the pause at 10:15 UTC.

What the upgrade broke

The bridge connects Ethereum with Ronin, the gaming-focused network associated with Axie Infinity. Such a bridge must release assets on one chain only after its authorization rules confirm the corresponding cross-chain action. Ronin said the August 6 upgrade had been deployed through its governance process, but it caused the bridge to misinterpret the vote threshold required from bridge operators before funds could be withdrawn.

That was the project’s event-day account, not a complete independent forensic conclusion. Ronin initially described the activity as a “potential MEV exploit” and said the actors appeared to be white hats who were responding in good faith. The public record on August 6 did not establish their identities or prove their intent before the funds were returned.

The project reported that approximately 4,000 ETH and 2 million USDC had been removed. It also said those amounts were the maximum permitted for a single withdrawal of each asset. The withdrawal limits therefore functioned as containment: they did not prevent unauthorized transactions, but Ronin said they prevented greater exposure after the threshold check failed.

Pause, return and bounty

Ronin said the ETH had been returned on August 6 and announced a $500,000 bug bounty for the white hats. A later update on August 6 confirmed receipt of the remaining 2 million USDC. The team said the bridge would undergo an audit before reopening and that a proposed change in bridge operations would be discussed with operators.

The same-day return is important to the accounting. The verified token movements represented temporary exposure, not a final loss of 4,000 ETH and 2 million USDC. Contemporaneous reports commonly converted the assets into a combined dollar estimate near $12 million, but that figure depended on the ETH price and timestamp used. This reconstruction therefore treats the token quantities and UTC transaction times as the stronger measurements and makes no independent dollar-loss or price-performance claim.

Why the incident mattered

The episode separated three controls that are often compressed into one claim of bridge security. Operator voting was intended to authorize withdrawals; per-transaction limits constrained the size of a failure; and an administrative pause stopped further bridge activity. On August 6, the first control malfunctioned, while the latter two limited the consequences.

For users and institutions, the distinction mattered because governance approval did not by itself establish that deployed code preserved the intended security assumptions. A change accepted through the proper process could still weaken execution if initialization, storage or threshold logic behaved differently after deployment. The return of the assets resolved the immediate shortfall, but it did not erase the need to verify the upgrade path before the bridge resumed service.

No later audit conclusion is projected into this account. As of the end of August 6, the confirmed record was a faulty upgrade, two bounded withdrawals, a bridge pause, return of both assets and a promised audit; a full technical postmortem remained outstanding.