Shiba Inu’s Layer 2 Shibarium Targeted in Flash Loan Attack, Nearly $3M Drained

According to Shiba Inu developer Kaal Dhairya, the attacker used a flash mortgage to borrow 4.6 million BONE, the governance token of Shibarium, and managed to achieve entry to 10 out of 12 validator signing keys.

That management gave them the two-thirds consensus required to finalize fraudulent checkpoints on the community’s consensus layer, Heimdall.

Shibarium Attacker Drains $2.4M in ETH and SHIB

With majority management in place, the attacker proceeded to empty round 224.57 ETH and 92.6 billion SHIB tokens from the Shibarium bridge contract, collectively price roughly $2.4 million on the time.

An additional $700,000 in KNINE tokens tied to K9 Finance had been additionally impacted. However, K9 Finance’s DAO moved swiftly to blacklist the attacker’s deal with, rendering the KNINE tokens unsellable.

In response to the breach, Shibarium builders halted staking and unstaking throughout the community.

Because the attacker’s borrowed BONE tokens stay topic to an unstaking delay, builders had been in a position to freeze the place earlier than full exit, successfully locking the attacker out of validator management in the intervening time.

Dhairya described the exploit as “refined” and advised it was possible “deliberate for months.”

Shibarium Bridge Security Update

Earlier at the moment, a classy ( in all probability deliberate for months ) assault was carried out utilizing a flash mortgage to buy 4.6M BONE. The attacker gained entry to validator signing keys, achieved majority validator energy, and signed a malicious…

— Kaal (@kaaldhairya) September 13, 2025

He confirmed that legislation enforcement has been contacted and that safety corporations Hexens, Seal 911, and PeckShield at the moment are concerned in the investigation.

He additionally left the door open to negotiations, stating that if the attacker returns the funds, a bounty may be thought of in lieu of authorized motion.

Community researcher Zilayo on X supplied a technical breakdown of the incident, pointing to suspicious validator conduct tied to Ryoshi Labs.

The fraudulent checkpoint was signed by 10 validators who managed round 40% of the stake.

Once the attacker delegated the flash-loaned BONE to Ryoshi’s validator, the weighted stake surpassed 66%, enabling a full consensus takeover.

Shibarium was attacked yesterday & the bridge drained for practically $3m. Here’s the way it occurred

1/ Ryoshi Labs’ validator (and maybe others) had been compromised or malicious from the beginning. They proposed a fraudulent checkpoint on Heimdall (Shibarium’s consensus engine).

2/… pic.twitter.com/yq1BdFYdra

— Zilayo (@0xZilayo) September 13, 2025

The worth of BONE spiked in the speedy aftermath of the assault, briefly rising from $0.165 to $0.294 earlier than settling again round $0.202.

SHIB, in the meantime, is up 4.5% in the previous 24 hours, pushed in half by renewed consideration following the breach.

Bitcoin Hacks, Thefts Cost Investors $2.2B in H1 2025: CertiK

Crypto traders lost over $2.2 billion to hacks, scams, and breaches in the primary half of 2025, pushed largely by pockets compromises and phishing assaults, in accordance with CertiK’s newest safety report.

Wallet breaches alone brought about $1.7 billion in losses throughout simply 34 incidents, whereas phishing scams accounted for over $410 million throughout 132 assaults.

Two main incidents, together with Bybit’s $1.5 billion hack in February and Cetus Protocol’s $225 million exploit in May, skewed the 12 months’s losses upward, collectively accounting for practically $1.78 billion.

Without these, losses align extra carefully with earlier years at round $690 million.

Ethereum remained the first goal, struggling over $1.6 billion in losses throughout 175 occasions.

The submit Shiba Inu’s Layer 2 Shibarium Targeted in Flash Loan Attack, Nearly $3M Drained appeared first on Cryptonews.