Ronin: Negotiating with attackers, user funds safe

Ronin released an update saying that the potential vulnerability of Ronin Bridge was discovered after being notified by the white hat hacker. After verification, the team suspended the operation of the bridge about 40 minutes after the first on-chain action. This time the attacker withdrew about 4000 ETH and 2 million USDC, worth about 12 million US dollars. This withdrawal amount is exactly the maximum amount that can be withdrawn in a single transaction, showing that the withdrawal limit of the bridge played a key role in this incident, effectively preventing larger losses.
The Ronin team said that today's bridge upgrade introduced an issue in the governance process that caused the system to misunderstand the threshold for bridge operator voting required to withdraw funds. The team is working to address this root cause, with plans to re-vote after a rigorous audit to ensure the security of the bridge. Currently, Ronin is in negotiations with the attacker, who appears to be acting as a white hat hacker and showing good will. Regardless of the outcome of the negotiations, all users' funds are safe and any shortfalls will be replenished when the bridge reopens.
The team also said that a post-mortem analysis will be released next week, detailing the technical details of the incident and future preventive measures.