In March 2022, a senior software engineer at Sky Mavis, the creator of the wildly popular blockchain game Axie Infinity, received a flattering message on LinkedIn. A recruiter representing an elite global firm was offering an incredibly lucrative job opportunity. Interested in the life-altering salary, the engineer entered a rigorous, multi-stage interview process, unaware that he was stepping into a meticulously crafted trap.
The "recruiter" was actually an operative of the Lazarus Group, a notorious state-sponsored hacking collective backed by the North Korean government. After multiple rounds of interviews, the engineer was sent a formal job offer packaged in a malicious PDF document. The moment he downloaded and opened the file on his work computer, spyware silently bypassed the network's security, initiating an infection chain that compromised the Ronin Network, the sidechain powering Axie Infinity.
The hackers hijacked five out of nine validator nodes on the Ronin network, gaining the private keys necessary to authorize transaction requests. In minutes, they drained 173,600 Ether and 25.5 million USDC, totaling a staggering $620 million in one of the largest cyber-heists in human history.
The Lazarus Group immediately moved the stolen assets through decentralized exchanges, chain-hopping across different blockchains, and utilizing Tornado Cash to wash their digital trail. The stolen funds were ultimately used to bankroll North Korea's ballistic missile programs. For Sky Mavis, the fallout was catastrophic, resulting in massive security restarts, the termination of the phished engineer, and a multimillion-dollar scramble to reimburse affected players. It remains a terrifying case study of how a single click on a fake job offer can dismantle a billion-dollar digital empire.
