Reconstructing the
Ronin Bridge incident.

A public incident is not yet a reviewable decision. Its record may be scattered across transaction receipts, company statements, agency actions, and later control changes. Each source may be useful. None should silently become the whole case.

That distinction matters when a compliance, investigations, or risk team needs to explain what it knew, when it knew it, and why it took, or did not take, a particular action. An audit-ready case is a workflow that preserves the source, separates a confirmed fact from contextual inference, records what remains unknown, and keeps the human reviewer’s decision path visible.

The March 2022 Ronin Bridge incident is a useful public example. It combines public on-chain transactions, later official attribution, sanctions-related follow-up, and a post-incident control redesign. The aim here is narrower. It reconstructs what a reviewer can support from public sources, and makes clear which questions still require authorised human review.

The case boundary comes before the story.

The review is deliberately limited to the public record from two Ethereum withdrawal transactions through later government actions that connected the event to a sanctions context. It does not use customer data, private intelligence, or a proprietary attribution model.

It also does not assume that an address, transaction, or public report alone establishes a person’s identity, intent, or legal liability. A case narrative becomes unreliable when it blends direct observation, third-party labels, and analyst interpretation into one unqualified conclusion.

What the timeline establishes.

Dates are part of the evidence. A careful record retains both the on-chain execution date and the later public reporting date when the sources use different wording.

23 March 2022 — public transaction records

Two public Ethereum transaction receipts associated with the historical Ronin Bridge incident record transfers of 173,600 ETH and 25.5 million USDC on 23 March 2022 in UTC. [Source 01 ↗] [Source 02 ↗] The ledger supports a narrow statement: the listed transactions executed and the recorded assets moved. It does not independently establish who controlled every address or why the transactions were initiated.

29 March 2022 — public reporting

The FBI later referred to the theft as reported on 29 March, while Ronin’s June recap also used that date to describe when the assets were drained. [Source 03 ↗] [Source 04 ↗] An audit-ready timeline should retain the two dates as distinct until the evidence reconciles them.

14 April and 6 May 2022 — external findings

On 14 April, the FBI said it had confirmed that Lazarus Group and APT38 were responsible for the reported theft. This is a source-linked statement about the FBI’s published attribution, not an independent conclusion by Bloxio or the reviewing team. [Source 03 ↗] On 6 May, OFAC stated that Blender.io processed more than $20.5 million of proceeds from the Axie Infinity heist and published additional virtual-currency identifiers. [Source 05 ↗]

What is confirmed, and what stays qualified.

The goal is not to erase uncertainty. It is to make uncertainty reviewable and to show exactly where the narrative stops.

The audit-ready checklist.

Before a case leaves an investigation workflow, another authorised reviewer should be able to reconstruct its evidence, uncertainty, and human decision path without relying on memory or unlinked tabs.

What this means for a post-alert workflow.

The Ronin case is not an argument that more blockchain data automatically produces a better decision. The relevant information was public, but it appeared across different systems and at different times: transaction records, an agency attribution, an OFAC action, and later remediation documentation.

For an investigator, the useful output is a narrative that preserves the chain of evidence and makes confidence and uncertainty explicit. It can support a human reviewer who needs to request information, follow an organisation’s escalation route, document no action, or take another policy-permitted step. It should not claim to make the decision by itself.

That is the workflow Bloxio is exploring with Scout: investigation support that turns permitted evidence into an evidence-backed, case-ready narrative, while keeping the decision and the responsibility for it with human review.