Ronin ‘white hat’ attacker returns $10M in ETH after apparent accidental front-run

The maximum extractable value (MEV) bot that drained nearly 3,996 Ether (ETH) from the Ronin network bridge on Aug. 6 has returned nearly all of the funds, according to data from block explorer Etherscan. This indicates that the bot may have accidentally front-run the attack. At the time the ETH was returned, it was worth more than $10 million.

The bot returned the funds at 3:04 pm UTC. A total of 3,991 ETH was transferred to the Ronin team, while the remaining 5 ETH has not been returned. The Ronin team announced the return on social media platform X and stated that the bot’s owner was being rewarded $500,000 for discovering the exploit.

The team said it will only allow the bridge to be reopened after the vulnerability is patched and an audit is performed.

MEV bots are programmed to copy transactions and pay a higher gas fee to execute them first if doing so is profitable. For this reason, they sometimes accidentally exploit protocols. If an attacker attempts to exploit a protocol but fails to pay a high enough gas fee, for example, an MEV bot may automatically copy the attack and drain a protocol of funds. In these cases, the bot’s owner will usually return the funds to the victim, as has happened in this case.

The drained funds were originally reported as worth more than $10 million.

Related: Ronin Network exploited for $9.8M in ETH, white hat hacker suspected

In July, a similar case occurred, as an MEV bot drained the Rho Markets protocol of over $8 million. The bot’s owner eventually returned all of the funds.

Ronin was also exploited for over $600 million in March 2022. It is the home of Axie Infinity, a Web3 game that claims to have over 2.7 million users.