Ronin: Attackers withdrew about 4,000 ETH and 2 million USDC, and are negotiating with white hat hackers

Ronin posted on the X platform that earlier today, white hats notified Ronin of a possible vulnerability in the bridge. After verifying the report, the bridge was suspended about 40 minutes after the first on-chain operation was discovered. The attacker withdrew about 4,000 ETH and 2 million USDC, worth about $12 million, which is the maximum amount of ETH and USDC that can be withdrawn from the bridge in a single transaction withdrawal. The bridge limit is an important guarantee to improve the security of large fund withdrawals and effectively prevent further damage caused by this vulnerability. Ronin said that due to an issue introduced after the bridge upgrade was deployed through the governance process, the cross-chain bridge misunderstood the bridge operator voting threshold required to withdraw funds. Efforts are currently underway to find a solution to the root cause, and the bridge update will be subject to strict review and then the bridge operator will vote on whether to deploy it. Negotiations are currently underway with the actors who appear to be white hat hackers, and they have responded in good faith. Regardless of the outcome of the negotiations, all user funds are safe and any shortfall will be re-deposited when the bridge opens. A post-mortem analysis will be shared next week, presenting technical details and planned measures to prevent similar incidents in the future.