Receipt 006: Ronin — the Ethereum leg, measured

# Receipt 006: Ronin — the Ethereum leg

Executive summary

On 23 March 2022 a wallet with no prior history submitted two transactions to the Ronin bridge contract on Ethereum, one minute and fifty-five seconds apart, and received 173,600.000000 ETH and 25,500,000.00 USDC. They were that wallet's nonce 0 and nonce 1 — the first two things it ever did. Seventeen minutes later it sent two 1.00 ETH test transfers, then went quiet for five days before beginning to disperse the ETH across 26 addresses.

Seven of those 26 destinations appear on the OFAC SDN list under the same entity as the subject — LAZARUS GROUP, programme DPRK3 — and they received 144,836.00 ETH, 79.5% of everything that left.

Every number above is measured from Ethereum transaction data, not taken from a report. The ETH account reconciles exactly: 182,267.91 in, 182,165.96 out, 0.1545 in gas, leaving 101.8025 ETH — the balance the address holds today.

What this receipt does not do is reconstruct the validator-key compromise. That happened on Ronin, a chain this reconstruction does not cover, and everything here about *how* the withdrawals were authorised is attributed to Sky Mavis, not measured by us.

This is a retrospective trace of an event that has already happened. It is not a prediction, not a live warning, and not an allegation of legal guilt against any named party.

The receipt

Transaction trail

Both withdrawals were initiated by the subject, not sent to it: each is a zero-value call from the subject to the bridge contract, and the value arrives as an internal transfer in the same transaction. That is why a tool reading only txlist sees 8,667.91 ETH of inbound here instead of 182,267.91 — a twenty-fold understatement. The internal transfers are where the money is.

The gas funder

The 1.0569 ETH that paid for both withdrawals came from 0x4976a4a02f38326660d17bf34b431dc6e2eb2327, an externally-owned account which was at nonce 1,084,134 when it sent it. A nonce that high is consistent with a high-throughput service rather than an individual, but we do not label this address and we do not name it. Public reporting attributes it; we have not verified that attribution and therefore do not repeat it.

Timeline

T+0 (13:16:57) — The wallet receives its first ever transaction: 1.0569 ETH, enough for gas.

T+12m (13:29:09) — Nonce 0. A zero-value call to the bridge contract returns 173,600 ETH as an internal transfer.

T+14m (13:31:04) — Nonce 1. The same call, same selector, same contract, returns 25,500,000 USDC.

T+30m and T+33m (13:46:46, 13:49:41) — Two 1.00 ETH transfers to two different addresses. Round numbers, minutes apart, immediately after the withdrawals: consistent with testing a route before committing size to it. That reading is an inference from the pattern, not something the chain states.

T+5 days (2022-03-28 02:30:38) — The first 500 ETH moves. Dispersal runs from here to 2022-05-04 for the bulk, with a final 2.00 ETH in March 2023.

Six days after T+0, per Sky Mavis, the withdrawals were noticed. That date is theirs, not ours.

What this receipt establishes

Directly verifiable from the transactions above, with no intermediary:

• The subject wallet withdrew 173,600.000000 ETH and 25,500,000.00 USDC from 0x1a2a1c93…54f2 on 23 March 2022, in two transactions 115 seconds apart.
• Those withdrawals were the wallet's first two transactions ever (nonce 0 and 1). It was created for this.
• 182,165.96 ETH subsequently left across 31 value-bearing transactions to 26 distinct addresses.
• The ETH account closes to the wei: 182,267.91 received − 182,165.96 sent − 0.1545 gas = 101.8025 ETH, matching the address's live balance.
• 144,836.00 ETH (79.5% of outflow) went to seven addresses carrying OFAC designations under LAZARUS GROUP / DPRK3.

This reconstruction is complete, not truncated: 430 normal and 2 internal transactions, both well under Etherscan's 10,000-row cap. Where a list *was* truncated, it is said so below.

OFAC cross-reference

Screened against our committed copy of the OFAC SDN list, exact-match on address:

Four things this does not mean.

1. The designations came later. These transfers happened in 2022; the designations are recorded in a list we read in 2026. Our snapshot carries an empty listed_on for every one of these entries, so we cannot state when any of them was designated and do not. Nothing here says these addresses were sanctioned *at the time the ETH moved*. 2. A match is not a finding about a person. An address on the SDN list is an address the US Treasury has designated. It is not a conviction, and this document names no natural person. 3. The list we screened against is a point-in-time copy, generated 2026-09-03 from treasury.gov/ofac/downloads/sdn.xml, not a live query. OFAC amends the SDN list without a schedule, so a screen against a stale copy can miss a designation made since. 4. The other 19 destinations are not cleared. They did not match our copy of the list. That is the absence of a match, which is not the same as the absence of a problem, and 37,329.96 ETH went to them.

What can and cannot be said

Measured by us, from Ethereum: every amount, address, hash, block, nonce and timestamp in this document, and the arithmetic that closes the account.

Attributed to Sky Mavis, not measured by us: the $624M valuation, the count of five of nine validator keys, the mechanism by which four keys came from a Sky Mavis infrastructure compromise and a fifth from delegated signing access, and the six-day delay before discovery. This reconstruction covers the Ethereum leg only; the validator compromise happened on Ronin and we did not trace it.

Inferred, and labelled as inference: that the two 1.00 ETH transfers were route tests. The chain shows two small round-number sends minutes after the withdrawals; it does not show intent.

Not established at all: who controlled the wallet, where the funds ultimately went after the hops traced here, and the identity of the gas funder.

Method and limitations

Transactions were read from the Etherscan V2 API on Ethereum mainnet (chainid=1): txlist (430 rows), txlistinternal (2 rows) and tokentx. Amounts are raw values normalised by token decimals; totals are summed from successful transactions only (isError == "0"). Gas is gasUsed × gasPrice over transactions sent by the subject.

The ERC-20 picture is truncated and the ETH picture is not. The token-transfer list returned 5,000 rows and hit the provider's page cap, so any ERC-20 total here other than the single USDC withdrawal is a lower bound. That address has received 4,967 transfers of one spam token, which is what fills the cap. The USDC figure is safe because the list is sorted ascending and the withdrawal is among the earliest rows. The ETH analysis used complete lists.

This reconstruction does not cover the Ronin chain. The free Etherscan tier does not serve it — nor BNB Chain, Base or Optimism — so the Ronin-side validator transactions are outside what this document can verify. That is a limit of our data access, not a judgement that nothing happened there.

The analysis is retrospective and incomplete by design. It does not identify a natural person, prove intent, cover every downstream hop, or constitute legal, investment, or sanctions advice. It makes no claim that Scienter predicted this event.

Screenshot policy

Scienter's /ledger/[hash] page accepts Scienter call hashes; it is not a general transaction renderer. We did not manufacture dashboard screenshots for foreign hashes the route cannot resolve. The explorer permalinks above are the canonical visual receipts.

Source index

• Sky Mavis community alert — the $624M figure, the validator-key account, and the discovery date
• OFAC SDN list — the designations, read from our 2026-09-03 snapshot
• Subject wallet on Etherscan — every transaction cited above