The Norwegian government has successfully frozen and returned $5.7 million in funds connected to the notorious $600 million Ronin exploit of 2022. Ronin, an Ethereum sidechain supporting the play-to-earn web3 game Axie Infinity, created by Sky Mavis, was targeted in what remains the largest DeFi exploit in history.

Sky Mavis announced on social media platform X that the recovery was achieved through the coordinated efforts of multiple parties. The Norwegian National Authority for Investigation and Prosecution of Economic and Environmental Crime (Økokrim) played a crucial role, alongside law enforcement agencies, lawyers, accountants, and blockchain forensics firms like Chainalysis.

Sky Mavis noted that 15% of the recovered funds will cover recovery expenses, with the remaining funds being deposited into the Axie Infinity treasury. The game developer expressed deep gratitude to Økokrim and the FBI for their relentless efforts in tracking and recovering the stolen assets.

To date, approximately $40 million in separate assets related to the exploit have been frozen by various law enforcement authorities. However, Sky Mavis cautioned that the recovery of these funds will take time, with no specific timetable available for their return.

The Ronin exploit, which occurred in March 2022, resulted in the theft of over $600 million in crypto assets, including 173,600 ETH (worth approximately $590 million at the time) and $25.5 million in USDC. The attack has been linked to North Korea's Lazarus Group, which has also been associated with other significant hacks, such as the $100 million Harmony bridge exploit in January 2023.

The breach occurred when the attacker compromised five out of nine validator private keys on the Ronin network. With control over these validators, the attacker was able to authorize and execute fraudulent transactions, draining funds from the Ronin bridge, a mechanism for transferring assets between the Ronin sidechain and the Ethereum mainnet.