RU

AML check on Ronin

Ronin is the gaming network behind Axie Infinity. Addresses look like Ethereum's (0x..., once shown as ronin:...), and its bridge suffered a 2022 theft the FBI tied to North Korea.

Address format0x followed by 40 hexadecimal characters; older apps show the same address as ronin:… (a cosmetic change since February 2024)0xfc9eb245ddc960d8812f9fcc1596e73fc04953e2Example for illustration, not a real address.
Note

A 0x address on Ronin and the same-looking 0x address on Ethereum belong to separate networks, so make sure you are on Ronin before you send or check anything. The 2022 bridge theft was attributed to North Korea’s Lazarus Group and the thief’s address is under US sanctions, so AML checkers may flag wallets connected to those funds.

Services that check Ronin

01TRM LabsEnterprise platformPrice on requestSupportedNot scored
02Merkle ScienceEnterprise platformPrice on requestNot verifiedNot scored

How to check a Ronin address

  1. Get the public addressAsk your counterparty for the address they will send from — or copy it from the incoming transaction.
  2. Pick a service that covers RoninChoose one marked “Supported” in the list above. If a tool rejects a 'ronin:' address, swap 'ronin:' for '0x'. Ronin says the prefix change is cosmetic and the rest of the address stays the same.
  3. Run the check and read itBefore you rely on a checker's result, make sure it is checking the Ronin network specifically, not Ethereum or another EVM chain.
A real AML check needs only a public address. Never share a seed phrase or private key.

Ronin specifics

  • In February 2024 Ronin began showing addresses with '0x' instead of 'ronin:'. Ronin says the change is purely cosmetic, does not affect funds, and that Sky Mavis apps would keep supporting the 'ronin:' prefix for now.[1]
  • On 12 May 2026 Ronin changed from a standalone chain into an Ethereum layer 2 built on Optimism's OP Stack. Layer 2 means a network that runs on top of Ethereum and relies on Ethereum for security. The switch was a scheduled network upgrade (a 'hard fork') at block 55,577,490, with about 10 hours of downtime.[2]
  • Ronin confirmed the move was complete and that it is 'now a Layer 2 on Ethereum'. RON is still the token used to pay network fees ('gas'), and Ronin said most users did not need to do anything.[3]
  • Ronin's official documentation now describes the network as 'an Ethereum L2 built for gamified experiences and real-world crypto adoption'.[4]
  • In April 2025 the Ronin Bridge finished moving to Chainlink CCIP, a third-party cross-chain messaging system. Tokens worth over USD 450M moved off the old bridge, and the new setup links Ronin with Ethereum and Base.[5]
  • Ronin says 173,600 ETH and 25.5M USDC were drained from the Ronin bridge (theft disclosed on 29 March 2022). It says Sky Mavis reimbursed the losses and 'all users have been made whole'. The bridge reopened on 28 June 2022.[6]
  • Elliptic reports that on 14 April 2022 the US Treasury’s sanctions office (OFAC) sanctioned the Ronin bridge thief’s Ethereum address and listed its owner as Lazarus Group, the North Korean state hacking group.[7]

Common risks on Ronin

Stolen fundsHighCoins taken in hacks of exchanges, protocols or personal wallets.SanctionsHighAddresses on government sanctions lists or owned by listed entities.DeFi protocolLowEstablished on-chain lending, swaps and liquidity pools.

FAQ

Is a 'ronin:' address different from a '0x' address?

No. In February 2024 Ronin started showing addresses with '0x' instead of 'ronin:'. Ronin says the change is purely cosmetic and your address and funds stay the same. At the time, Sky Mavis said its apps would still accept 'ronin:'.

Is Ronin still a separate blockchain?

Ronin became an Ethereum layer 2 (built on the OP Stack) on 12 May 2026. RON is still used to pay network fees, and Ronin said most users did not need to take any action.

What happened in the 2022 Ronin bridge hack?

In March 2022, 173,600 ETH and 25.5M USDC were drained from the Ronin bridge. The FBI attributed the theft of $620 million in Ethereum to the North Korea-linked Lazarus Group and APT38, the US Treasury sanctioned the thief’s Ethereum address, and Ronin says Sky Mavis reimbursed all users.

How do I check a Ronin address for AML risk?

Copy the public address, open one of the services listed above that supports Ronin, and run the check. You never need a seed phrase or private key.

What does “Not verified” mean?

The service claims support somewhere — in marketing copy or a third-party page — but its own docs, pricing or FAQ do not list the network. Treat it as unknown.

Sources

  1. Ronin Network (blog.roninchain.com) — Introducing New 0x Prefixes for Ronin Addresses (2 Feb 2024). Checked 4 Oct 2026.
  2. Ronin Network (blog.roninchain.com) — Ronin is coming home to Ethereum on May 12th! (22 Apr 2026). Checked 4 Oct 2026.
  3. Ronin Network (blog.roninchain.com) — Ronin is Home. (13 May 2026). Checked 4 Oct 2026.
  4. Ronin (docs.roninchain.com) — Introduction - Ronin Docs (12 May 2026). Checked 4 Oct 2026.
  5. Ronin Network (blog.roninchain.com) — The Ronin Bridge <> Chainlink CCIP migration is complete! (25 Apr 2025). Checked 4 Oct 2026.
  6. Ronin Network (blog.roninchain.com) — The Ronin Bridge Is Open (28 Jun 2022). Checked 4 Oct 2026.
  7. Elliptic — North Korea’s Lazarus Group identified as exploiters behind $540 million Ronin bridge heist (29 Mar 2022). Checked 4 Oct 2026.