- Shibarium exploit drained 92.6B SHIB and 224 ETH through a validator takeover.
- Attacker used 4.6M BONE in a flash-loan-style move to gain majority control.
- Shiba Inu team has paused functions, secured funds, and launched a full investigation.
Days ago, X user PeckShield raised concerns of suspicious activity linked to Shibarium. An exploit on Shibarium led to the theft of bridge assets, including 92.6 billion SHIB and 224.57 ETH, in what appears to be a highly sophisticated validator compromise.
How the Exploit Happened
According to the Shiba Inu team, the attacker leveraged funds from a prior bridge hack within the same block as the exploit. Using these stolen assets, they acquired 4.6 million BONE tokens, which were then temporarily delegated to gain validator voting power. This move resembled a flash loan transaction, designed to secure the required authority in just one block.
Related: Shiba Inu Price Prediction: SHIB Faces Tight Range as Bulls Eye $0.00001314 Breakout
With this control, the attacker was able to sign a malicious state on Shibarium, before repaying the transaction with assets drained from the bridge. Importantly, the BONE tokens remain locked in validator delegation and cannot currently be withdrawn.
Validator Compromise
Evidence suggests that 10 out of 12 validator signing keys were compromised during the incident. The only exceptions were validators operated by K9 Finance and UnificationUND, both of which refused to sign the malicious state.
Without the flash-loan-style purchase and delegation of approximately $1 million worth of BONE, the attacker would not have been able to secure the two-thirds majority needed to authorize the exploit.
Assets Affected
The stolen assets include:
- 92.6B SHIB
- 224.57 ETH
The attacker also attempted to liquidate around $700,000 worth of KNINE tokens, but these efforts were thwarted after K9 Finance DAO multisig blacklisted the attacker’s wallet.
Other ecosystem tokens such as LEASH, ROAR, TREAT, BAD, and SHIFU remain untouched for now.
Immediate Response
The Shiba Inu team moved quickly to mitigate further risk:
- Stake/unstake functions on Shibarium were paused to protect community funds.
- Stake manager funds were transferred from proxy contracts into a secure 6-of-9 hardware multisig wallet.
- Security firms Hexens, Seal911, and PeckShield have been engaged to conduct a full forensic investigation.
Next Steps
The team outlined its ongoing priorities:
- Secure transfer of validator keys and confirmation of full chain integrity.
- Restoration of stake manager funds once security is assured.
- Continued collaboration with security partners to freeze attacker-linked funds.
- A full incident report will be published following the investigation.
Commitment to the Community
In a statement, the team emphasized its dedication to transparency:
“The #ShibArmy deserves clarity and accountability. This is a fast-moving investigation, and we are working around the clock with leading security partners. Please bear with us — verified updates will be shared as soon as possible.”
The incident underscores the persistent risks facing decentralized ecosystems and the importance of robust validator security. For now, the Shiba Inu community awaits further updates as investigators work to trace and recover the stolen funds.