Security as a Sociotechnical Property: A STAMP–CAST Analysis of the 2022 Ronin Bridge Compromise

Five stolen keys don’t explain the USD 600 million Ronin bridge theft. For four months before the March 2022 attack, a single firm could reach the signing threshold of a scheme built to need five independent signers, and no one was responsible for noticing. This paper applies Causal Analysis based on System Theory (CAST) to thirteen public sources coded into a 63-fact evidence log. It models a control structure in which signing authority was split across peer organisations with no common superior, and identifies nine unsafe control actions across five controllers and four flaws in the structure itself. The central finding is drift: a signing delegation granted in November 2021 to absorb heavy user load outlived its purpose by three months because ending it was nobody’s job, behind a bridge contract that checked nothing but a signature count and with no loop from a public outflow to the pause function that already existed. Compared against the operator’s post-mortem and four bridge-security analyses, the post-mortem discloses almost every organisational cause, while the literature reduces the incident to “compromised keys”. Production pressure behind the delegation is the one cause no account names, and the players who carried the loss held no control action. The operator’s headline fix, more validators, does not touch the mechanism that failed. The full evidence log, coding record and comparison are included so every judgement can be checked.