“The attacker managed to get control over Sky Mavis’s four Ronin Validators and a third-party validator run by Axie DAO.”
The bridge needed five signatures out of nine, and Sky Mavis held four of them. The attacker drained 173,600 ETH and 25.5M USDC on March 23. Nobody noticed for six days, until a user couldn’t withdraw. “Decentralized” meant one company and a friend, and the security model was a single phishing target.