Verify a decision

{"actor":"system:backfill","investigation_id":"6771ec46-d413-494b-aee3-28e5e0551943","kind":"publish","page_slug":"shibarium-bridge-flash-loan-exploit-september-2025","published_at":"2026-09-24T12:05:58.471Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Shibarium Bridge Flash Loan Exploit (September 2025)","sections":[{"content":"At approximately 18:44 UTC on September 12, 2025, an unidentified attacker exploited Shibarium's Ethereum cross-chain bridge, draining assets valued at approximately $4.1 million according to multiple subsequent reports. Earlier estimates at the time of initial disclosure cited figures between $2.3 million and $2.4 million; the higher figure of $4.1 million reflects fuller on-chain accounting of 17 different token types confirmed in later developer and media reports. The Shiba Inu development team issued a public community update on September 17, 2025, describing the attack mechanism and immediate response measures. Bridge operations were suspended immediately following detection. The incident represents one of the most significant exploits in Shibarium's operational history since the network launched in 2023.","heading":"Incident Overview","severity":"critical","sources":[{"credibility":2,"name":"Shibarium bridge suffers 'sophisticated' flash loan attack, with $2.4 million drained — The Block","type":"news_article","url":"https://www.theblock.co/post/370536/shibarium-bridge-suffers-sophisticated-flash-loan-attack-with-2-4-million-drained"},{"credibility":2,"name":"$4.1M Shibarium Bridge Hack: SHIB Tanks, BONE Collapses & Validator Keys Compromised — CCN","type":"news_article","url":"https://www.ccn.com/education/crypto/shibarium-bridge-hack-shib-bone-crash-explained/"},{"credibility":2,"name":"Shib on X: Community Update 17/09/2025 — Official @Shibtoken","type":"social_media","url":"https://x.com/Shibtoken/status/1968419499528581286"},{"credibility":2,"name":"Shibarium Bridge Security Update — blog.shib.io","type":"official","url":"https://blog.shib.io/shibarium-bridge-security-update/"}]},{"content":"The attack combined a flash loan with what security researchers and the development team described as a fundamental flaw in Shibarium's BONE token delegation model. According to on-chain records and developer statements, the sequence proceeded as follows: (1) the attacker obtained 4.6 million BONE tokens via a flash loan from ShibaSwap in a single transaction block; (2) the borrowed BONE was delegated to Ryoshi Validator 1, temporarily amplifying the attacker's stake to exceed the two-thirds consensus threshold required to authorize state changes on Shibarium's Heimdall consensus layer; (3) with supermajority control, the attacker signed a malicious checkpoint and pushed fraudulent exit proofs to Shibarium's Ethereum-linked PoS bridge contracts; (4) the fraudulent proofs triggered automatic withdrawals of multiple assets from the bridge contract. Security firm Vibranium Audits characterized the root architectural flaw as insufficient protection against temporary token concentration during single-block operations, noting that the governance token could be weaponized through flash loans. The development team's own post-incident assessment identified a likely compromise of internal validator signing keys — attributed to possible exposure on a developer machine or key management service — as a compounding factor: evidence indicated 10 of the 12 active validator signing keys had been compromised prior to or during the attack, with only the K9 Finance DAO and Unification validators declining to co-sign the malicious state. The K9 Finance DAO blacklisted the attacker's address. Developer Kaal Dhairya stated the operation appeared to have been planned for months.","heading":"Attack Mechanism","severity":"critical","sources":[{"credibility":2,"name":"Shibarium suffers $2.3–$3M Validator and Bridge Exploit — Vibranium Audits","type":"research","url":"https://www.vibraniumaudits.com/post/shibarium-suffers-2-3--3m-validator-and-bridge-exploit----network-integrity-tested"},{"credibility":2,"name":"Shibarium bridge exploited, $2.4m lost in flash loan attack — crypto.news","type":"news_article","url":"https://crypto.news/shibarium-bridge-exploited-2-4m-lost-flash-loan-attack/"},{"credibility":2,"name":"SHIB Updates on Shibarium Bridge Exploit, Validator Key Lockdown Underway — Blockonomi","type":"news_article","url":"https://blockonomi.com/shib-updates-on-shibarium-bridge-exploit-validator-key-lockdown-underway/"},{"credibility":2,"name":"$4.1M Shibarium Bridge Hack: SHIB Tanks, BONE Collapses & Validator Keys Compromised — CCN","type":"news_article","url":"https://www.ccn.com/education/crypto/shibarium-bridge-hack-shib-bone-crash-explained/"}]},{"content":"On-chain records document theft across at least 17 token types. Reported breakdowns from multiple outlets, citing the developer community update of September 17, 2025, include approximately $1.0–1.05 million in ETH (224.57 ETH), approximately $1.3 million in SHIB (92.6 billion tokens), approximately $680,000 in LEASH, approximately $717,000 in KNINE, approximately $260–284,000 in ROAR, and smaller quantities of additional ecosystem tokens including BAD (Bad Idea AI). The attacker subsequently liquidated holdings incrementally: by September 22, 2025, the attacker had offloaded all BAD token holdings, swapping the final batch of 2,057 BAD for approximately 3.2 ETH; on September 20, the same wallet liquidated 1.01 billion SHIB for approximately 2.9 ETH. The 4.6 million BONE tokens used in the flash loan were recovered by the Shiba Inu team on September 13, 2025, by freezing staking — the BONE had remained locked in Validator 1 due to unstaking delays — and were subsequently removed through a targeted recovery process correcting legacy unbonding data. No material recovery of the other stolen assets was reported.","heading":"Assets Drained","severity":"critical","sources":[{"credibility":2,"name":"Shibarium Bridge Hacker Offloads Entire BAD Holdings — CoinSpeaker","type":"news_article","url":"https://www.coinspeaker.com/shibarium-bridge-hacker-offloads-bad-holdings/"},{"credibility":2,"name":"Shiba Inu Recovers 4.6 Million BONE Tokens After Major Shibarium Bridge Exploit — CoinCentral","type":"news_article","url":"https://coincentral.com/shiba-inu-recovers-4-6-million-bone-tokens-after-major-shibarium-bridge-exploit/"},{"credibility":3,"name":"Shibarium bridge restored after exploit, 4.6 million BONE tokens recovered — Bitget News","type":"news_article","url":"https://www.bitget.com/news/detail/12560604999570"},{"credibility":2,"name":"Shibarium bridge hit with $2.4 million flash loan attack — Web3 Is Going Great","type":"news_article","url":"https://www.web3isgoinggreat.com/single/shibarium-bridge-hit-with-2-4-million-flash-loan-attack"}]},{"content":"The Shiba Inu development team suspended bridge operations immediately upon detecting the exploit. Staking and unstaking functions were paused network-wide, which had the effect of trapping the 4.6 million BONE the attacker had delegated, preventing full liquidation of those tokens. Stake manager funds were transferred from proxy contracts to a 6-of-9 hardware multisig wallet. All 12 validator signing keys were rotated. Over 100 ecosystem contracts were migrated to secure wallets. Three blockchain security firms — Hexens, Seal 911, and PeckShield — were engaged for forensic investigation. Developer Kaal Dhairya stated that law enforcement authorities had been contacted. On September 17, 2025, the official Shiba Inu social account published a community update detailing the attack vector. The development team stated it was open to negotiating with the attacker in good faith and offered a 50 ETH bounty (approximately $225,000 at the time) for the return of stolen funds, with an offer of leniency and no charges pressed. Kaal Dhairya confirmed that negotiations ultimately failed and the attacker moved the stolen assets. Over 1,200 wallets were reported as affected by the breach.","heading":"Immediate Response and Containment","severity":"high","sources":[{"credibility":2,"name":"Shibarium Now Faces Test of Resilience After Over $4M Hack — The Shib Magazine","type":"news_article","url":"https://magazine.shib.io/shibarium-now-faces-test-of-resilience-after-over-4m-hack/"},{"credibility":2,"name":"Shib on X: Community Update 17/09/2025 — Official @Shibtoken","type":"social_media","url":"https://x.com/Shibtoken/status/1968419499528581286"},{"credibility":3,"name":"Shiba Inu Team Offers $229,000 Bounty to Recover $4.1M from Shibarium Bridge Hack — Bitget News","type":"news_article","url":"https://www.bitget.com/news/detail/12560604974297"},{"credibility":2,"name":"'We are aware...': Shiba Inu team responds after $2.4 mln Shibarium bridge attack — AMBCrypto","type":"news_article","url":"https://ambcrypto.com/we-are-aware-shiba-inu-team-responds-after-2-4-mln-shibarium-bridge-attack/"}]},{"content":"Following forensic investigation and security hardening, Shibarium reactivated the Plasma Bridge for the BONE token on October 14, 2025, approximately five weeks after the exploit. The reopened bridge incorporated two primary new defensive mechanisms: a mandatory seven-day finalization delay on all withdrawals, providing a monitoring window before funds are released, and a proactive blacklist function enabling the team to immediately block suspicious addresses. All updates were validated through simulation, testnet deployment on Puppynet, and independent security audit by Hexens. Developer Kaal Dhairya indicated plans to expand bridge support beyond BONE to additional ecosystem tokens following further security validation. The development team published the post: 'Plasma (BONE) Bridge Is Back — Stronger and More Secure Than Ever' on blog.shib.io to formally announce the restoration. Full PoS bridge restoration for the broader token set remained in progress as of the bridge relaunch.","heading":"Bridge Restart and Security Upgrades","severity":"medium","sources":[{"credibility":2,"name":"Shibarium Plasma Bridge Returns Stronger With 7-Day Delay & Blacklist Protection — TronWeekly","type":"news_article","url":"https://www.tronweekly.com/shibarium-plasma-bridge-returns-stronger-with-7"},{"credibility":3,"name":"Shibarium Reactivates BONE Plasma Bridge After $4.1 Million Exploit with Enhanced Security Measures — Bitget News","type":"news_article","url":"https://www.bitget.com/news/detail/12560605016128"},{"credibility":2,"name":"Shiba Inu Reopens Shibarium Bridge, But Hack Victims Still Face Repayment Delay — The Crypto Basic","type":"news_article","url":"https://thecryptobasic.com/2025/10/15/shiba-inu-reopens-shibarium-bridge-but-hack-victims-still-face-repayment-delay/"},{"credibility":2,"name":"Shibarium Brings Back Plasma Bridge for BONE After Security Upgrade — Blockonomi","type":"news_article","url":"https://blockonomi.com/shibarium-brings-back-plasma-bridge-for-bone-after-security-upgrade"}]},{"content":"As of the bridge's partial reopening on October 14, 2025, approximately 1,200 affected wallets had not yet received compensation for stolen assets. The development team announced a phased refund program, with Kaal Dhairya stating the team was designing a plan to 'make users whole' via careful gating, phased limits, and partner coordination. However, no specific compensation timeline, distribution date, or per-wallet calculation methodology had been publicly disclosed as of the bridge relaunch. Most stolen assets — beyond the recovered 4.6 million BONE — remained in the possession of the attacker or had been liquidated by the attacker prior to any recovery. The Shiba Inu team indicated compensation details would be released 'when it is safe to do so.' No court proceedings, insurance mechanism, or third-party guarantee of compensation were reported.","heading":"User Compensation","severity":"high","sources":[{"credibility":2,"name":"Shiba Inu's Shibarium preps bridge restart and plans user refunds after $4 million exploit — The Block","type":"news_article","url":"https://www.theblock.co/post/373368/shiba-inu-shibarium-preps-bridge-restart-plans-user-refunds-after-4-million-exploit"},{"credibility":2,"name":"Shibarium Reboots After $4M Hack, Pledges User Refunds — Finance/Yahoo","type":"news_article","url":"https://finance.yahoo.com/news/shibarium-reboots-4m-hack-pledges-202257291.html"},{"credibility":2,"name":"Shibarium to Relaunch Bridge After $4M Hack, Refund Plan in Progress — Analytics Insight","type":"news_article","url":"https://www.analyticsinsight.net/news/shibarium-to-relaunch-bridge-after-4m-hack-refund-plan-in-progress"},{"credibility":2,"name":"Shiba Inu Recovers 4.6 Million BONE Tokens After Major Shibarium Bridge Exploit — CoinCentral","type":"news_article","url":"https://coincentral.com/shiba-inu-recovers-4-6-million-bone-tokens-after-major-shibarium-bridge-exploit/"}]},{"content":"Following the exploit, SHIB declined approximately 13% and BONE dropped over 43% in value in the days immediately after September 12, 2025, according to multiple market reports. Some reports noted a partial recovery: The Street reported a 42% surge in SHIB in the days following disclosure, attributed in part to community sentiment and the team's rapid containment response. BONE's collapse was more persistent given the token's central role in the exploit's mechanism. As of October 2025, SHIB was reported trading at approximately $0.0000127, with capital inflow described as limited.","heading":"Market Impact","severity":"medium","sources":[{"credibility":2,"name":"Shiba Inu's Shibarium bridge hacked, token surges 42% — TheStreet Crypto","type":"news_article","url":"https://www.thestreet.com/crypto/markets/shiba-inus-shibarium-bridge-hacked-in-flash-loan-exploit-token-rallies-41"},{"credibility":2,"name":"Shibarium to Relaunch Bridge After $4M Hack, Refund Plan in Progress — Analytics Insight","type":"news_article","url":"https://www.analyticsinsight.net/news/shibarium-to-relaunch-bridge-after-4m-hack-refund-plan-in-progress"}]},{"content":"Security researchers and the development team identified two compounding vulnerabilities: (1) a structural flaw in Shibarium's consensus model whereby BONE tokens delegated within a single block counted toward validator voting power without a time-lock or cooldown, enabling a flash loan to transiently manufacture a two-thirds supermajority; (2) the apparent compromise of 10 of 12 validator signing keys, which was a prerequisite for the attacker pushing the fraudulent checkpoint. The first flaw is architectural and does not require malicious insider access — it could in principle be reproduced by any actor with access to sufficient BONE liquidity in a single block. The second flaw suggests either an operational security failure (developer machine compromise, leaked key material, or KMS misconfiguration) or a coordinated insider action; no definitive attribution was published as of the bridge relaunch. The combination of both flaws in a live bridge holding user funds represents a critical design-level failure. The post-exploit security rebuild addressed operational controls (key rotation, multisig migration, blacklisting, withdrawal delays) but the long-term architectural mitigation — preventing flash loan amplification of governance delegation — had not been fully detailed in public documentation as of October 2025.","heading":"Architectural Risk Assessment","severity":"critical","sources":[{"credibility":2,"name":"Shibarium suffers $2.3–$3M Validator and Bridge Exploit — Vibranium Audits","type":"research","url":"https://www.vibraniumaudits.com/post/shibarium-suffers-2-3--3m-validator-and-bridge-exploit----network-integrity-tested"},{"credibility":2,"name":"SHIB Updates on Shibarium Bridge Exploit, Validator Key Lockdown Underway — Blockonomi","type":"news_article","url":"https://blockonomi.com/shib-updates-on-shibarium-bridge-exploit-validator-key-lockdown-underway/"},{"credibility":2,"name":"Shibarium bridge exploited, $2.4m lost in flash loan attack — crypto.news","type":"news_article","url":"https://crypto.news/shibarium-bridge-exploited-2-4m-lost-flash-loan-attack/"}]},{"content":"The requester's context cites September 17, 2026 as the exploit date. Based on corroborating reports from The Block, crypto.news, Vibranium Audits, CoinSpeaker, Blockonomi, The Shib Daily, and the on-chain timestamp of approximately 18:44 UTC, the exploit occurred on September 12, 2025. September 17, 2025 was the date of the official Shiba Inu community update describing the attack. The bridge reopened on October 14, 2025. This investigation reflects the 2025 dates as established by those sources.","heading":"Note on Reported Dates","severity":"low","sources":[{"credibility":2,"name":"Shibarium Bridge Security Update — blog.shib.io","type":"official","url":"https://blog.shib.io/shibarium-bridge-security-update/"},{"credibility":2,"name":"Shibarium bridge exploited, $2.4m lost in flash loan attack — crypto.news","type":"news_article","url":"https://crypto.news/shibarium-bridge-exploited-2-4m-lost-flash-loan-attack/"}]}],"sources_used":[{"credibility":2,"name":"Shibarium bridge suffers 'sophisticated' flash loan attack, with $2.4 million drained — The Block","type":"news_article","url":"https://www.theblock.co/post/370536/shibarium-bridge-suffers-sophisticated-flash-loan-attack-with-2-4-million-drained"},{"credibility":2,"name":"Shiba Inu's Shibarium preps bridge restart and plans user refunds after $4 million exploit — The Block","type":"news_article","url":"https://www.theblock.co/post/373368/shiba-inu-shibarium-preps-bridge-restart-plans-user-refunds-after-4-million-exploit"},{"credibility":2,"name":"$4.1M Shibarium Bridge Hack: SHIB Tanks, BONE Collapses & Validator Keys Compromised — CCN","type":"news_article","url":"https://www.ccn.com/education/crypto/shibarium-bridge-hack-shib-bone-crash-explained/"},{"credibility":2,"name":"Shiba Inu's Shibarium bridge hacked, token surges 42% — TheStreet Crypto","type":"news_article","url":"https://www.thestreet.com/crypto/markets/shiba-inus-shibarium-bridge-hacked-in-flash-loan-exploit-token-rallies-41"},{"credibility":2,"name":"Shibarium Bridge Security Update — blog.shib.io (official)","type":"official","url":"https://blog.shib.io/shibarium-bridge-security-update/"},{"credibility":2,"name":"Shibarium bridge hit with $2.4 million flash loan attack — Web3 Is Going Great","type":"news_article","url":"https://www.web3isgoinggreat.com/single/shibarium-bridge-hit-with-2-4-million-flash-loan-attack"},{"credibility":2,"name":"Shibarium bridge exploited, $2.4m lost in flash loan attack — crypto.news","type":"news_article","url":"https://crypto.news/shibarium-bridge-exploited-2-4m-lost-flash-loan-attack/"},{"credibility":2,"name":"Shibarium suffers $2.3–$3M Validator and Bridge Exploit — Vibranium Audits","type":"research","url":"https://www.vibraniumaudits.com/post/shibarium-suffers-2-3--3m-validator-and-bridge-exploit----network-integrity-tested"},{"credibility":2,"name":"SHIB Updates on Shibarium Bridge Exploit, Validator Key Lockdown Underway — Blockonomi","type":"news_article","url":"https://blockonomi.com/shib-updates-on-shibarium-bridge-exploit-validator-key-lockdown-underway/"},{"credibility":2,"name":"Shibarium Now Faces Test of Resilience After Over $4M Hack — The Shib Magazine","type":"news_article","url":"https://magazine.shib.io/shibarium-now-faces-test-of-resilience-after-over-4m-hack/"},{"credibility":2,"name":"$2M+ Shibarium Bridge Exploit: Crucial Response Now Limits Losses — The Shib Daily","type":"news_article","url":"https://news.shib.io/2025/09/16/2m-shibarium-bridge-exploit-crucial-response-now-limits-losses/"},{"credibility":2,"name":"Shib on X: Community Update 17/09/2025 — @Shibtoken","type":"social_media","url":"https://x.com/Shibtoken/status/1968419499528581286"},{"credibility":2,"name":"Shibarium Bridge Hacker Offloads Entire BAD Holdings — CoinSpeaker","type":"news_article","url":"https://www.coinspeaker.com/shibarium-bridge-hacker-offloads-bad-holdings/"},{"credibility":2,"name":"Shiba Inu Recovers 4.6 Million BONE Tokens After Major Shibarium Bridge Exploit — CoinCentral","type":"news_article","url":"https://coincentral.com/shiba-inu-recovers-4-6-million-bone-tokens-after-major-shibarium-bridge-exploit/"},{"credibility":2,"name":"Shibarium Reboots After $4M Hack, Pledges User Refunds — Yahoo Finance","type":"news_article","url":"https://finance.yahoo.com/news/shibarium-reboots-4m-hack-pledges-202257291.html"},{"credibility":2,"name":"Shibarium to Relaunch Bridge After $4M Hack, Refund Plan in Progress — Analytics Insight","type":"news_article","url":"https://www.analyticsinsight.net/news/shibarium-to-relaunch-bridge-after-4m-hack-refund-plan-in-progress"},{"credibility":2,"name":"Shibarium Plasma Bridge Returns Stronger With 7-Day Delay & Blacklist Protection — TronWeekly","type":"news_article","url":"https://www.tronweekly.com/shibarium-plasma-bridge-returns-stronger-with-7"},{"credibility":2,"name":"Shiba Inu Reopens Shibarium Bridge, But Hack Victims Still Face Repayment Delay — The Crypto Basic","type":"news_article","url":"https://thecryptobasic.com/2025/10/15/shiba-inu-reopens-shibarium-bridge-but-hack-victims-still-face-repayment-delay/"},{"credibility":2,"name":"Shibarium Reactivates BONE Plasma Bridge — crypto.news","type":"news_article","url":"https://crypto.news/shiba-inu-news-shibarium-announces-plasma-bridge-for-bone/"},{"credibility":3,"name":"Shiba Inu Team Offers $229,000 Bounty to Recover $4.1M from Shibarium Bridge Hack — Bitget News","type":"news_article","url":"https://www.bitget.com/news/detail/12560604974297"}],"summary":"On September 12, 2025, the Shibarium Ethereum-to-Layer-2 bridge suffered a multi-step exploit in which an attacker acquired 4.6 million BONE tokens via flash loan, used them to seize a supermajority of validator signing power, and drained approximately $4.1 million across at least 17 token types. The Shiba Inu development team suspended bridge operations, rotated all validator keys, recovered the flash-loaned BONE, and reopened the Plasma (BONE) Bridge on October 14, 2025 with a mandatory seven-day withdrawal delay and blacklist protections; a phased user compensation plan was announced but had not been fully distributed as of the bridge reopening.","timeline":[{"date":"2025-09-12","event":"Exploit executed at approximately 18:44 UTC. Attacker obtained 4.6M BONE via flash loan, delegated to Ryoshi Validator 1, achieved two-thirds validator supermajority, signed malicious checkpoint, and drained approximately $4.1M across 17 token types from the Shibarium PoS bridge.","source":"Vibranium Audits post-incident report; crypto.news; Blockonomi","source_url":"https://www.vibraniumaudits.com/post/shibarium-suffers-2-3--3m-validator-and-bridge-exploit----network-integrity-tested"},{"date":"2025-09-13","event":"Shiba Inu team froze staking and unstaking functions, trapping the 4.6M BONE in Validator 1. Stake manager funds moved to 6-of-9 hardware multisig. Security firms Hexens, Seal 911, and PeckShield engaged. 4.6M BONE subsequently recovered via targeted unbonding correction.","source":"CoinCentral; Blockonomi; crypto.news","source_url":"https://coincentral.com/shiba-inu-recovers-4-6-million-bone-tokens-after-major-shibarium-bridge-exploit/"},{"date":"2025-09-17","event":"Official Shiba Inu account (@Shibtoken) published community update confirming attack vector, 17 tokens affected, 50 ETH bounty offer to attacker, and confirmation that negotiations were open.","source":"Shib on X; The Block; CCN","source_url":"https://x.com/Shibtoken/status/1968419499528581286"},{"date":"2025-09-20","event":"Attacker's wallet liquidated 1.01 billion SHIB for approximately 2.9 ETH, indicating active movement of stolen assets.","source":"CoinSpeaker","source_url":"https://www.coinspeaker.com/shibarium-bridge-hacker-offloads-bad-holdings/"},{"date":"2025-09-22","event":"Attacker offloaded final BAD (Bad Idea AI) token holdings — 2,057 BAD swapped for 3.2 ETH via MetaMask. Developer Kaal Dhairya confirmed negotiations had failed and stolen assets had been moved.","source":"CoinSpeaker; The Crypto Basic","source_url":"https://www.coinspeaker.com/shibarium-bridge-hacker-offloads-bad-holdings/"},{"date":"2025-10-14","event":"Shibarium reactivated the Plasma Bridge for BONE with mandatory seven-day withdrawal delay and proactive blacklist function. Security validated by Hexens. Compensation plan for approximately 1,200 affected wallets announced but not yet distributed.","source":"TronWeekly; The Crypto Basic; Blockonomi; Bitget News","source_url":"https://www.tronweekly.com/shibarium-plasma-bridge-returns-stronger-with-7"}]},"v":1}