DAOUSDT
DAO Maker / Tether USD
cryptoComposite

Short answer: not really. With 4 of the 5 needed signatures sitting at one company, the actual security model was "trust Sky Mavis plus one extra key", and the leftover DAO allowlist quietly turned it into just "trust Sky Mavis". Counting validators tells you a lot less than counting independent organizations and how many of them would have to be compromised at once. It also wasn't a one-off. Harmony's Horizon bridge lost about $100M in June 2022 with a 2-of-5 multisig, and that one was pinned on Lazarus too. Same pattern: a small signer set, with keys on machines a phishing campaign can reach. Ronin's own fix afterwards was raising the threshold from 5 of 9 to 8 of 11, which helps, but the part of your write-up that stands out more is the monitoring 🔍 Six days without anyone noticing 173,600 ETH leave is worse than the multisig math. When I look at a bridge now I check three things: how many separate entities hold signing keys, whether large withdrawals have a delay or rate limit, and whether temporary permissions like that allowlist ever get reviewed after they're granted.

Yeah, it’s based on the security exchange act, the exchange act, and the DAO report, and the supreme courts application of the Howey test… [You should read it](https://www.cftc.gov/sites/default/files/2026/03/2026-05635a.pdf) there is one really interesting bit right at the end though..Michael Selig is both the only appointed commissioner currently at the CFTC, AND the acting chairman… ”on this matter, Chairman Selig voted in the affirmative. No commissioner voted in negative.” this document isn’t worth pissing on…

**Fun fact with bad timing:** in April 2022, Binance led the $150M round that went toward paying back Ronin's users after the hack. On Oct 31, the FBI said North Korea was behind the more than $6B that just left Binance itself. Ronin is still the cleanest example of how this keeps working. Most people remember it as "one guy opened a fake job offer." The company's own postmortem tells a longer story. **The setup** * Ronin was Axie Infinity's own chain. Money crossed over a bridge run by **9 validators, and any 5 signatures could approve a withdrawal.** * Sky Mavis, the studio behind Axie, ran **4 of the 9.** * Why only 5? Their own Q&A: some nodes "didn't catch up with the chain, or were stuck in syncing state." **The favor nobody switched off** * Nov 2021: the network was getting hammered, so Sky Mavis asked the Axie DAO for help handing out free transactions. The DAO allowlisted Sky Mavis to sign on its behalf. * Dec 2021: the arrangement ended. Their words: "the allowlist access was not revoked." * So signature #5 was still reachable from inside Sky Mavis. **The drain** * The Block later reported (two anonymous sources) that a senior engineer got a fake job offer after several rounds of interviews, sent as a PDF. Sky Mavis declined to comment on how it happened. Its postmortem only says "one employee was compromised." * Mar 23, 2022: two withdrawals, **13:29:09 and 13:31:04 UTC. 115 seconds apart.** 173,600 ETH and 25.5M USDC, about $625M. * Nobody noticed for **six days.** Their words: "We didn't have a proper tracking system for monitoring large outflows from the bridge." The alarm was a user who couldn't withdraw 5,000 ETH. **The part I keep thinking about:** users were paid back in coins. ETH had dropped so much by the time the bridge reopened in June that the refund was worth about $216.5M. And the Axie DAO, the group that did the favor, didn't get its own 56,000 ETH covered in that refund. Question for people who know bridges better than me: **is a 5-of-9 multisig with 4 keys at one company decentralized in any real sense?** And how many bridges today look the same if you squint? I made a 14 minute doc on the whole chain (the FBI naming Lazarus, the money going through mixers, the roughly 10% that got seized back) for a small channel I started a few weeks ago. Sources are on screen the whole way. If you want the full story with the visuals: [https://www.youtube.com/watch?v=63\_InzH4fO4](https://www.youtube.com/watch?v=63_InzH4fO4) Honest feedback welcome, I'm still learning this.