Worked example · 2022-04

Ronin Bridge Discord-impersonation followups — Axie Infinity / Ronin community — 2022-04 (cohort)

Loss: ~$300k+ aggregate across the cohort of follow-on Discord-phishing extractions targeting Axie Infinity / Ronin community members in the wake of the headline March 23, 2022 Ronin Bridge incident (examples/2022-03-ronin-bridge.md). Per-victim losses ranged from a few thousand dollars to mid-five-figure individual cases; the cohort-aggregate ~$300k figure is the lower-bound estimate widely cited in the public record. The actual aggregate is likely materially higher because individual social-engineering follow-up extractions of this shape are systematically under-reported.
Recovery: none of consequence on-chain. Some affected users were reimbursed by Sky Mavis under the broader Ronin Bridge user-make-whole programme that followed the March 23 incident, but the reimbursement programme was scoped to the headline bridge loss and did not generally cover the Discord-phishing follow-on extractions.
OAK Techniques observed: OAK-T4.005 (setApprovalForAll Drainer / NFT-asset extraction primitive) — primary; the canonical extraction shape used by the follow-on phishing cohort was a setApprovalForAll drainer prompting the victim to approve a malicious operator address on AXS / SLP / RON / Axie NFT collections, followed by transferFrom extraction by the attacker. OAK-T15.005 (Operator-Communication-Channel Takeover) — anchor for the Discord-channel sub-shape; the cohort exploited compromised or impersonated Discord channels (community-server impersonation, DM impersonation of Sky Mavis staff, fake "claim AXS reimbursement" portals). OAK-T11 (Operator-Side Communication-Channel Compromise) — the cohort exploited compromised or impersonated Discord channels (community-server impersonation, DM impersonation of Sky Mavis staff, fake "claim AXS reimbursement" portals); the operational vector is operator-Discord-credential-compromise / impersonation rather than direct on-chain primitive.
Attribution: pseudonymous across the cohort. Multiple attacker addresses, no consolidated named-cluster attribution; the cohort is structurally a multi-operator opportunistic phishing wave rather than a single coordinated campaign. No OAK-G01 / state-actor attribution. The cohort is structurally distinct from the canonical Ronin Bridge incident itself (which is OAK's confirmed-attribution G01 case) — the follow-on phishing wave is the opportunistic-secondary-cohort that piggy-backed on the headline incident's user-confusion environment.
Key teaching point: The Ronin Discord cohort is OAK's canonical worked example of the secondary-cohort phishing wave that follows a headline bridge incident. The structural observation — that headline incidents create user-confusion environments that are themselves attack surfaces — is one of the most generalisable operational lessons in the public record, and the Ronin Discord cohort is the cleanest 2022 instance.

Summary

In the days and weeks following the March 23, 2022 Ronin Bridge incident (examples/2022-03-ronin-bridge.md), a wave of follow-on Discord-phishing extractions targeted Axie Infinity / Ronin community members. The operational shape was opportunistic: with the headline bridge incident generating a large volume of confused, anxious, and information-seeking users in the Axie / Ronin Discord ecosystem, multiple attacker operators set up impersonation infrastructure (fake "Sky Mavis support" Discord servers, DM impersonation of Sky Mavis staff, fake "claim your AXS reimbursement" web portals) and targeted users with social-engineering pretexts that prompted them to sign setApprovalForAll calls on AXS, SLP, RON, or Axie NFT collections.

The canonical extraction shape: a victim is contacted via Discord DM by an account impersonating Sky Mavis support; the impersonator directs the victim to a fake portal claiming to process a reimbursement of funds lost in the headline bridge incident; the portal prompts the victim's wallet to sign a setApprovalForAll(operator, true) call on a target ERC-20 or NFT contract; once the victim signs, the attacker calls transferFrom from the approved operator address and drains the assets. Per-incident losses ranged from a few thousand dollars to mid-five-figure individual cases; the cohort-aggregate is at least ~$300k and likely materially higher.

For OAK's purposes, this is the canonical companion case to the Ronin Bridge headline incident — the structural lesson being that headline-incident user-confusion environments are themselves an attack surface, and that secondary-cohort phishing waves systematically follow major incidents in the public record. The cohort is a clean T4.005 worked example and a clean T11 worked example, paired together because the attack surface (compromised operator Discord channels and the user-confusion environment those channels produce) is what enabled the on-chain extraction primitive.

Timeline (UTC)

When	Event	OAK ref
2022-03-23 (headline incident)	Ronin Bridge drained for ~$625M; documented at `examples/2022-03-ronin-bridge.md`	(precursor — out-of-scope for this case)
2022-03-29 (public disclosure)	Sky Mavis publicly discloses the bridge incident; Axie / Ronin Discord ecosystem floods with confused, anxious users seeking information about losses and reimbursement	(user-confusion environment opens)
2022-03-29 onward (cohort window)	Multiple attacker operators set up impersonation infrastructure (fake Discord servers, impersonator DM accounts, fake reimbursement-claim web portals) targeting the user-confusion environment	T11 operator-Discord impersonation infrastructure
2022-03-29 onward (per-victim window)	Victims approached via Discord DM under "Sky Mavis support" pretext; directed to fake reimbursement portal; prompted to sign `setApprovalForAll` call on AXS / SLP / RON / Axie NFT contract	T4.005 setApprovalForAll drainer entry
2022-03-29 onward (per-victim window)	Attacker calls `transferFrom` from the approved operator address; victim's assets extracted	T4.005 extraction
2022-04 (cohort persists)	Phishing wave continues for several weeks; cumulative cohort-aggregate loss reaches ~$300k+ across known reports	cohort persistence
2022-04 onward (operator response)	Sky Mavis issues repeated user-facing communications warning of the impersonation campaign; community moderators and users surface attacker accounts; Discord attacker accounts taken down on report	(operator-side mitigation)
Subsequent	Sky Mavis user-make-whole programme is scoped to the headline bridge loss; the Discord-phishing follow-on losses are largely not reimbursed	(no recovery for the cohort)

What defenders observed

Pre-cohort (operator-side comms posture): the user-confusion environment created by the headline bridge incident was itself an attack surface. Operators of major affected protocols had not, as of early 2022, established a comms-channel-integrity discipline of the form "any official Sky Mavis communication will only ever come from this verified source; reimbursement processing will only happen via this canonical flow; we will never DM you to process a reimbursement." That comms-discipline became a baseline post-2022 expectation; pre-cohort, it was inconsistent. The Ronin Discord cohort is the canonical 2022 instance pushing the industry toward this comms-discipline baseline.
At-cohort (per-victim signal): the extraction transaction was a setApprovalForAll(maliciousOperator, true) call followed by transferFrom from the operator. The signal at the wallet-software layer is "this approval is being granted to a non-marketplace, non-protocol operator address". Wallet-side warning UX for this pattern was inconsistent in 2022; the dominant 2024-era wallet-software ecosystem (Rabby, MetaMask post-2023 hardening, Frame) materially improved the surface, although the per-cohort prevention rate remains uneven.
At-cohort (off-chain signal): the impersonator-account signal was visible on Discord (account creation date, role assignments, message-history shape) but the Discord moderation surface was not equipped in 2022 to flag impersonator accounts at the speed the phishing cohort moved. Discord-side surface-area for crypto-impersonation moderation has materially improved post-2023, although as of v0.1 cutoff impersonation-as-attack-vector remains a recurring class.
Post-cohort: no on-chain recovery primitive. The Sky Mavis user-make-whole programme was scoped to the headline bridge loss and did not extend to the Discord-phishing follow-on cohort; affected users absorbed the loss.

What this example tells contributors writing future Technique pages

Headline incidents create secondary-cohort attack surfaces. Major bridge / DeFi / NFT incidents reliably produce a follow-on phishing wave targeting the user-confusion environment the headline incident creates. Contributors writing future T4 / T11 examples should treat the secondary-cohort wave as a structurally expected feature of the post-headline-incident environment, not as an unrelated coincidence. The Ronin Discord cohort, the Bored Ape Yacht Club Discord compromise ([baycdiscord2022], [bayccmgr2022]), and several subsequent cases form a recurring cohort-shape OAK should preserve.
T4.005 + T11 is a recurring composite. The setApprovalForAll drainer is the on-chain extraction primitive; the operator-Discord-channel compromise / impersonation is the social-engineering surface that gets victims to sign. The two Techniques are independent but fire together in the dominant 2022-era NFT-phishing cohort. Contributors writing future T4.005 examples should explicitly note the T11 surface that delivered the prompt; contributors writing future T11 examples should explicitly note the T4-class extraction primitive that completed the loss.
Cohort losses are systematically under-reported. The ~$300k cohort-aggregate figure is a lower-bound. Per-victim losses in social-engineering follow-on cohorts are systematically under-reported relative to headline incident losses because individual victims do not have an industry forensic provider tracking their loss in real time. Contributors writing future cohort cases should mark the under-reporting bias explicitly when citing aggregate-loss figures.
Comms-discipline maturation is a defensive-baseline observation. The post-Ronin-2022 industry developed a comms-discipline of the form "we will only ever communicate via this verified channel; we will never DM you; reimbursement processing happens only via this canonical flow." The Ronin Discord cohort is the canonical 2022 case that pushed this comms-discipline into the industry baseline; subsequent incidents (Curve DNS hijack examples/2022-08-curve-dns-hijack.md, Mixin Network) test the limits of the baseline against more sophisticated channel-compromise vectors.

Public references

[ellipticronin2022] — Elliptic primary forensic write-up of the headline March 23 Ronin Bridge incident; provides the user-confusion environment context that the follow-on phishing cohort exploited. Already in OAK citations.
[skymavisronindiscord2022] (proposed) — Sky Mavis user-facing warnings of the Discord impersonation campaign; primary operator-side source for the cohort's existence and shape.
[chainabusedronindiscord2022] (proposed) — Industry threat-intelligence reporting (Chainabuse / similar) on the Ronin Discord-impersonation cohort; documents per-attacker-address victim aggregation and approximate cohort-aggregate loss.
[checkpoint2023drainers] — Check Point Research drainer-ecosystem overview; not a primary source for the Ronin Discord cohort but provides the dominant-pattern context for the setApprovalForAll extraction primitive that the cohort used. Already in OAK citations.
[baycdiscord2022] and [bayccmgr2022] — Bored Ape Yacht Club Discord-compromise companion cases from the same period; structurally similar T11 + T4 composite. Already in OAK citations.

Discussion

The Ronin Discord cohort is OAK's canonical worked example of the secondary-cohort phishing wave that follows a headline bridge incident. The structural observation — that headline incidents create user-confusion environments that are themselves attack surfaces — is one of the most generalisable operational lessons in the public record, and the Ronin Discord cohort is the cleanest 2022 instance.

The case is the companion piece to the Ronin Bridge headline incident (examples/2022-03-ronin-bridge.md), and the two together span the structural impact of a major bridge incident: the headline loss ($625M, OAK-G01-attributed, T10.001) plus the secondary-cohort phishing wave (~$300k+, pseudonymous opportunistic operators, T4.005 + T11). The pairing is structurally important because OAK's per-incident worked-example framing risks under-representing the secondary-cohort impact when the headline incident dominates the record. Contributors writing future major-incident worked examples should consider whether a companion piece on the secondary-cohort wave is warranted; the Ronin Discord case is the model.

A subtle observation: the secondary-cohort attribution profile (multiple opportunistic operators, no coordinated campaign) is structurally distinct from the headline-incident attribution profile (G01-confirmed, single coordinated campaign). The two attribution shapes do not interact: the secondary-cohort operators are not G01-affiliated; they are opportunists piggy-backing on the user-confusion environment. Contributors should not collapse the two attribution shapes into a single G01-flavoured framing — the headline incident is G01; the secondary cohort is pseudonymous-opportunistic. The same pattern recurs at subsequent major incidents (the Bybit February 2025 follow-on phishing cohort, the FTX November 2022 follow-on phishing cohort), and OAK's framework needs to preserve the distinction.

Contributors writing future T4.005 + T11 composite cases should reach for the Ronin Discord case as the comparison reference for the secondary-cohort shape specifically: the user-confusion environment created by a headline incident, the impersonation infrastructure set up to exploit it, and the setApprovalForAll drainer as the on-chain extraction primitive. The shape is recurring and the Ronin Discord 2022 instance is the cleanest 2022 record.