An “ingenious” flash loan attack allowed a hacker to extract around $2.3 million in ETH and SHIB from the Shibarium bridge, which connects the L2 network with Ethereum.
UPDATE 13/09/25
What we know so far about the recent incident 👇
How the exploit was executed:
• The attacker used funds from the bridge hack in the same block as the attack to acquire 4.6M BONE to temporarily gain validator voting power, attempting to do it in one… https://t.co/4Ft1VMxeBv
— Shib (@Shibtoken) September 13, 2025
The Shiba Inu team suggested that the attacker had been planning the operation for several months.
During the attack, the hacker borrowed 4.6 million BONE, Shibarium’s governance tokens, and compromised 10 out of 12 network validator keys. By gaining control over the consensus mechanism, the hacker transferred 224.57 ETH and 92.6 billion SHIB from the bridge’s smart contract to their own address.
The hacker also seized KNINE tokens worth approximately $700,000 from the K9 Finance DAO project within the Shibarium ecosystem. According to Shiba Inu developers, the attack affected LEASH, ROAR, TREAT, BAD, and SHIFU coins. However, these assets have not yet been moved or sold.
Following the incident, the team took the following actions:
- Suspended staking deposit and withdrawal functions;
- Transferred funds from proxy contracts to secure multi-signature hardware storage;
- Initiated an investigation in collaboration with Hexens, Seal911, and PeckShield.
Shiba Inu noted that the attacker cannot withdraw the 4.6 million BONE—the funds remain delegated to validators and are effectively frozen. Additionally, the hacker cannot liquidate KNINE, as K9 Finance DAO has blacklisted their address.
The team aims to:
- Return keys to validators once network integrity is confirmed;
- Restore staked funds as soon as their security is ensured;
- Continue coordinated efforts with partners to freeze assets linked to the hacker;
- Complete the investigation and publish a report on the incident.
Earlier in September, attackers stole 192,600 SOL worth $41 million from the Swiss crypto platform SwissBorg and hacked the DeFi platform Nemo for $2.4 million.