Shibarium Bridge Attack Halted, Funds Moved to Multi-Sig Wallet

• Hacker used flash loan to gain validator keys and target 4.6M BONE in Shibarium Bridge.
• Tokens remained locked due to unstaking delays, enabling swift freeze and response.
• Team halts staking and moves funds to multi-sig wallets amid opening talks for negotiations.

Shibarium’s bridge was struck by a coordinated attack after a hacker exploited a flash loan to acquire 4.6 million BONE tokens. According to developer Kaal Dhairya, the attacker gained validator signing keys and attempted to drain bridge assets. However, the exploit was interrupted, and frozen tokens remain locked due to unstaking restrictions.

Exploit Blocks BONE Withdrawals

Dhairya described the breach as “sophisticated,” suggesting it had been planned months earlier. The attacker used a flash loan to purchase millions of BONE before accessing validator keys. This access provided majority validator control, allowing the attacker to sign a malicious state and try to move assets out of the bridge.

However, the stolen BONE tokens were already delegated to Validator 1. Because of the protocol’s unstaking delays, the tokens could not be withdrawn. This delay gave the development team time to respond, following which they froze the compromised funds and stopped staking operations to prevent further risks.

Shibarium Bridge, which links Ethereum and Shibarium, is important to enabling token transfers in the marketplace. It supports SHIB, BONE, LEASH, and other assets, reducing fees and speeding up transactions for DeFi and gaming uses.

Emergency Steps to Secure Validator Assets

Following the breach, the team implemented immediate counter-measures. Staking and unstaking were paused, and funds managed by the stake manager were shifted into a hardware wallet. The hardware wallet is secured under a 6-of-9 multisig, which Dhairya confirmed is a temporary safeguard until validator control integrity is verified.

The measures, shared publicly on X by Dhairya, aimed to ensure validator security while further investigations continue. According to him, the primary focus is “protecting the network and community assets.” The team stated that once secure key transfers are complete, stake manager funds will be restored.

In addition, developers clarified that the origin of the compromise is not yet confirmed. They are examining whether the breach came from a server or a developer machine. Security firms Hexens, Seal 911, and PeckShield have been engaged to assist with the investigation.

Related: Whales, Wedges, and Shiba Inu: Can the Shibarium Upgrade Fuel a 30% Surge?

Investigations, Negotiations, and Security Concerns

Authorities have been notified, marking the incident as part of a wider probe into validator key security. Notably, the Shiba Inu team announced they are open to negotiating with the attacker and confirmed that they would not press any charges if the funds were returned, and also offered a bounty.

The attempted theft comes shortly after PeckShield flagged suspicious bridge activity, alerting developers to act quickly. Dhairya acknowledged the importance of these alerts in enabling a timely freeze of the 4.6 million BONE tokens.

Beyond this incident, the Shiba Inu ecosystem has also warned about phishing attempts on Discord. Scammers recently exploited expired links to lure users into fake servers where wallet “verification” drained balances. The warnings show the ecosystem’s broader security challenges, even as technical upgrades continue.

One of those upgrades is the upcoming migration of LEASH V2, which will use a fixed ratio swap model. Additionally, ShibaSwap recently introduced liquidity management improvements and a redesigned interface to support multi-chain trading. These updates indicate the continuing expansion of Shibarium despite the security breach.

The post Shibarium Bridge Attack Halted, Funds Moved to Multi-Sig Wallet appeared first on Cryptotale.