{"investigation":{"slug":"shido","entity_name":"Shido","trust_score":22,"severity_base":null,"score_modifier":0,"confidence":0.78,"status":"published","content_type":"investigation","summary":"Shido Network (SHIDO) is a Layer-1 proof-of-stake blockchain project founded in Sweden in 2021. On February 29, 2024, an attacker exploited the Ethereum-based SHIDO staking contract by transferring ownership to a new address and upgrading it with a hidden token-withdrawal function, draining over 4.3 billion tokens and causing the price to collapse 94% within 30 minutes. On-chain investigator ZachXBT linked the exploit to a serial hacker responsible for the OKX (December 2023) and Concentric Finance (January 2024) hacks, with the attack vector in each case being private key compromise via social engineering.","sections":[{"content":"On February 29, 2024, security firm PeckShield publicly disclosed an exploit against Shido Network's Ethereum staking contract. An attacker transferred ownership of the StakingV4Proxy contract to a new address (0x1982358c84da9d0b4b96fc9e8564d132f7d0041f) and then upgraded the contract to introduce a hidden withdrawToken() function. This function was immediately called to withdraw all 4,353,473,223.864904 SHIDO tokens — approximately half of the roughly 9 billion token circulating supply. The tokens were nominally valued at approximately $35 million at the time of the exploit; after rapid selling and price collapse, the attacker ultimately converted the position to approximately 956 ETH, representing roughly $3.3 million in realized proceeds. The SHIDO token price fell 94% within 30 minutes of the exploit becoming public.","heading":"The February 2024 Staking Contract Exploit","sources":[{"url":"https://www.cryptotimes.io/2024/02/29/shido-token-plummets-94-as-hacker-drains-staking-contract/","name":"cryptotimes.io","type":"other","credibility":3},{"url":"https://smartcontractshacking.com/hacks/shido-hack-2024","name":"smartcontractshacking.com","type":"other","credibility":3},{"url":"https://www.web3isgoinggreat.com/?id=shido-contract-exploit","name":"web3isgoinggreat.com","type":"other","credibility":3},{"url":"https://crypto.news/shido-token-dives-over-90-after-ethereum-staking-contract-exploit/","name":"crypto.news","type":"other","credibility":3}],"severity":"medium"},{"content":"On-chain investigator ZachXBT traced the exploiter's funding chain through the Across protocol on Arbitrum and via Layerswap, and identified an alleged link between the Shido exploit and two prior incidents: the OKX exploit (December 2023, approximately $2.7 million) and the Concentric Finance hack (January 22, 2024, approximately $1.8 million). ZachXBT noted that the funding wallet used to initiate the Shido attack appeared to have itself been compromised, as its assets were unexpectedly transferred shortly before funding the exploiter — suggesting the attacker may have used a previously hacked wallet as a launchpad. The common thread identified across all three incidents was private key compromise achieved through targeted social engineering: in the Concentric Finance case, the attacker posed as a job recruiter on a professional networking platform and induced a team member with deployer-wallet access to download malware disguised as a skills-assessment tool.","heading":"ZachXBT Investigation and Serial Hacker Link","sources":[{"url":"https://crypto.news/shido-token-dives-over-90-after-ethereum-staking-contract-exploit/","name":"crypto.news","type":"other","credibility":3},{"url":"https://medium.com/coinmonks/winter-2024-crypto-crime-report-private-key-exploits-new-serial-hacker-ponzi-schemes-fake-75f4c8b6e03d","name":"medium.com","type":"other","credibility":3},{"url":"https://www.cryptopotato.com/heres-why-the-shido-token-crashed-94-despite-the-ongoing-market-rally/","name":"cryptopotato.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Security analysts classified the root cause of the Shido exploit as a private key compromise leading to an access control failure. The critical vulnerability was not a bug in the contract's logic per se, but the ability for an owner to unilaterally upgrade the proxy contract without a timelock, multi-signature requirement, or community governance delay. Once the attacker controlled the owner key, the upgrade to add a hidden withdrawToken() function and the subsequent drain of the contract were executed in a single atomic sequence. The exploit was recorded on-chain via the transaction hash 0xaa76ea503fadddf775b1ef7f195676440fdc3ac46ab642798ab6fa7ae3aafcbe. The absence of a timelock on upgradeable proxy contracts is a widely recognized security deficiency in DeFi.","heading":"Technical Root Cause: Access Control Failure","sources":[{"url":"https://smartcontractshacking.com/hacks/shido-hack-2024","name":"smartcontractshacking.com","type":"other","credibility":3},{"url":"https://www.cryptotimes.io/2024/02/29/shido-token-plummets-94-as-hacker-drains-staking-contract/","name":"cryptotimes.io","type":"other","credibility":3}],"severity":"medium"},{"content":"Following the exploit, the Shido team issued a public statement stating that all users who had staked SHIDO would have their tokens returned, and directed users to the official website to assess eligibility for a compensatory fund. The team also replaced the compromised deployer address, temporarily suspended liquidity provisioning on all decentralized exchanges, and contacted centralized exchanges to disable deposits and freeze tokens associated with the hack. The team also publicly invited the exploiter to contact them to negotiate a bounty. However, no public third-party reports have confirmed that the promised refunds were fully executed, and no independent audit of the compensation process has been located. The project's token remains approximately 98.8% below its all-time high as of mid-2026.","heading":"Team Response and Alleged Refund Commitments","sources":[{"url":"https://www.bitcoininsider.org/article/242623/shido-network-shido-loses-half-its-token-supply-massive-hack","name":"bitcoininsider.org","type":"other","credibility":3},{"url":"https://invezz.com/news/2024/02/29/shido-network-shido-loses-half-of-its-token-supply-in-a-massive-hack/","name":"invezz.com","type":"other","credibility":3},{"url":"https://www.coingecko.com/en/coins/shido","name":"coingecko.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Shido Network was founded in 2021 and is based in Bromma, Sweden. The project's stated co-founders are Bjorn Bonnevier (CEO) and Edin Maloku. The protocol is described as a decentralized proof-of-stake Layer-1 blockchain powered by Tendermint, EVM, and CosmWasm, positioning itself as a cross-chain DeFi infrastructure. The team maintains a public profile on the project website and on X (formerly Twitter) as @ShidoGlobal. In early 2024, the project had announced its mainnet launch for the week following the exploit.","heading":"Project Background and Leadership","sources":[{"url":"https://tracxn.com/d/companies/shido/__TvkEEseDh7mlmW9L2-1NtswGovV95dgS_nc1uSqsoTA","name":"tracxn.com","type":"other","credibility":3},{"url":"https://shido.io/","name":"shido.io","type":"other","credibility":3},{"url":"https://crypto.news/shido-token-dives-over-90-after-ethereum-staking-contract-exploit/","name":"crypto.news","type":"other","credibility":3}],"severity":"medium"},{"content":"As of mid-2026, the SHIDO token continues to trade at a fraction of its pre-exploit value. CoinGecko data shows the token reached an all-time high of approximately $0.01277 and had fallen roughly 98.8% from that peak. The 24-hour trading volume as of the most recent data is approximately $60,461. The project has reportedly pursued additional exchange listings and commissioned third-party smart contract audits following the incident. No law enforcement action or regulatory proceeding against the project or identified perpetrators has been located in public records.","heading":"Post-Exploit Status and Token Price","sources":[{"url":"https://www.coingecko.com/en/coins/shido","name":"coingecko.com","type":"other","credibility":3},{"url":"https://coinmarketcap.com/currencies/shido-network/","name":"coinmarketcap.com","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2021","event":"Shido Network founded in Bromma, Sweden by Bjorn Bonnevier and Edin Maloku.","source":"","date_original":"2021-01-01"},{"date":"2023-12","event":"OKX exploit (~$2.7M) occurs; ZachXBT would later allege on-chain links to the Shido attacker.","source":"","date_original":"2023-12-01"},{"date":"2024-01-22","event":"Concentric Finance hacked for approximately $1.8M via social engineering / malware attack on a team member with deployer wallet access.","source":""},{"date":"2024-02-24","event":"Shido announces mainnet launch scheduled for the following week.","source":""},{"date":"2024-02-29","event":"Shido Ethereum staking contract exploited: ownership transferred, hidden withdrawToken() function introduced, 4.35 billion SHIDO tokens (~$3.3M realized) drained. Token price collapses 94% within 30 minutes. PeckShield publicly discloses the breach.","source":""},{"date":"2024-02-29","event":"ZachXBT traces exploiter funding through Across protocol (Arbitrum) and Layerswap; identifies alleged link to OKX and Concentric Finance hacks via shared attacker infrastructure.","source":""},{"date":"2024-02-29","event":"Shido team replaces compromised deployer address, suspends DEX liquidity provisioning, contacts CEXs to freeze associated tokens, and promises to refund all stakers.","source":""}],"sources_used":[{"url":"https://www.cryptotimes.io/2024/02/29/shido-token-plummets-94-as-hacker-drains-staking-contract/","name":"cryptotimes.io","type":"other","archive_url":"https://web.archive.org/web/20260829185933/https://www.cryptotimes.io/2024/02/29/shido-token-plummets-94-as-hacker-drains-staking-contract/","credibility":3,"archive_timestamp":"2026-08-29T18:59:33+00:00"},{"url":"https://smartcontractshacking.com/hacks/shido-hack-2024","name":"smartcontractshacking.com","type":"other","archive_url":"http://web.archive.org/web/20260829141733/https://smartcontractshacking.com/hacks/shido-hack-2024","credibility":3,"archive_timestamp":"2026-08-29T14:17:33+00:00"},{"url":"https://www.web3isgoinggreat.com/?id=shido-contract-exploit","name":"web3isgoinggreat.com","type":"other","archive_url":"http://web.archive.org/web/20260412223507/https://www.web3isgoinggreat.com/?id=shido-contract-exploit","credibility":3,"archive_timestamp":"2026-04-12T22:35:07+00:00"},{"url":"https://crypto.news/shido-token-dives-over-90-after-ethereum-staking-contract-exploit/","name":"crypto.news","type":"other","archive_url":"http://web.archive.org/web/20251007154040/https://crypto.news/shido-token-dives-over-90-after-ethereum-staking-contract-exploit/","credibility":3,"archive_timestamp":"2025-10-07T15:40:40+00:00"},{"url":"https://medium.com/coinmonks/winter-2024-crypto-crime-report-private-key-exploits-new-serial-hacker-ponzi-schemes-fake-75f4c8b6e03d","name":"medium.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://www.cryptopotato.com/heres-why-the-shido-token-crashed-94-despite-the-ongoing-market-rally/","name":"cryptopotato.com","type":"other","archive_url":"http://web.archive.org/web/20260216135547/https://cryptopotato.com/heres-why-the-shido-token-crashed-94-despite-the-ongoing-market-rally/","credibility":3,"archive_timestamp":"2026-02-16T13:55:47+00:00"},{"url":"https://www.bitcoininsider.org/article/242623/shido-network-shido-loses-half-its-token-supply-massive-hack","name":"bitcoininsider.org","type":"other","archive_url":"https://web.archive.org/web/20260830044817/https://www.bitcoininsider.org/article/242623/shido-network-shido-loses-half-its-token-supply-massive-hack","credibility":3,"archive_timestamp":"2026-08-30T04:48:17+00:00"},{"url":"https://invezz.com/news/2024/02/29/shido-network-shido-loses-half-of-its-token-supply-in-a-massive-hack/","name":"invezz.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.coingecko.com/en/coins/shido","name":"coingecko.com","type":"other","archive_url":"http://web.archive.org/web/20250806105959/https://www.coingecko.com/en/coins/shido","credibility":3,"archive_timestamp":"2025-08-06T10:59:59+00:00"},{"url":"https://tracxn.com/d/companies/shido/__TvkEEseDh7mlmW9L2-1NtswGovV95dgS_nc1uSqsoTA","name":"tracxn.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://shido.io/","name":"shido.io","type":"other","archive_url":"http://web.archive.org/web/20260610095800/https://shido.io/","credibility":3,"archive_timestamp":"2026-06-10T09:58:00+00:00"},{"url":"https://coinmarketcap.com/currencies/shido-network/","name":"coinmarketcap.com","type":"other","archive_url":"http://web.archive.org/web/20260517180054/https://coinmarketcap.com/currencies/shido-network/","credibility":3,"archive_timestamp":"2026-05-17T18:00:54+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:34.608021+00:00","updated_at":"2026-08-30T05:14:08.353494+00:00"}}