Skip to main content
AVOID.NET

Shibarium Bridge Flash Loan Exploit (September 2025)

avoid.net/shibarium-bridge-flash-loan-exploit-september-2025→22/100·72% conf.
[AI-DRAFTED · AWAITING VERIFICATION]

Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.

anchored·2PQhqs…dfsz

Summary

On September 12, 2025, the Shibarium Ethereum-to-Layer-2 bridge suffered a multi-step exploit in which an attacker acquired 4.6 million BONE tokens via flash loan, used them to seize a supermajority of validator signing power, and drained approximately $4.1 million across at least 17 token types. The Shiba Inu development team suspended bridge operations, rotated all validator keys, recovered the flash-loaned BONE, and reopened the Plasma (BONE) Bridge on October 14, 2025 with a mandatory seven-day withdrawal delay and blacklist protections; a phased user compensation plan was announced but had not been fully distributed as of the bridge reopening.

Connected Entities

1 entity

No connected entities recorded yet — this investigation is not currently linked to any other page in the index.

Have evidence about Shibarium Bridge Flash Loan Exploit (September 2025)?

Timeline(6 events)

12 September 2025

Exploit executed at approximately 18:44 UTC. Attacker obtained 4.6M BONE via flash loan, delegated to Ryoshi Validator 1, achieved two-thirds validator supermajority, signed malicious checkpoint, and drained approximately $4.1M across 17 token types from the Shibarium PoS bridge.

Vibranium Audits post-incident report; crypto.news; Blockonomi

13 September 2025

Shiba Inu team froze staking and unstaking functions, trapping the 4.6M BONE in Validator 1. Stake manager funds moved to 6-of-9 hardware multisig. Security firms Hexens, Seal 911, and PeckShield engaged. 4.6M BONE subsequently recovered via targeted unbonding correction.

CoinCentral; Blockonomi; crypto.news

17 September 2025

Official Shiba Inu account (@Shibtoken) published community update confirming attack vector, 17 tokens affected, 50 ETH bounty offer to attacker, and confirmation that negotiations were open.

Shib on X; The Block; CCN

20 September 2025

Attacker's wallet liquidated 1.01 billion SHIB for approximately 2.9 ETH, indicating active movement of stolen assets.

CoinSpeaker

22 September 2025

Attacker offloaded final BAD (Bad Idea AI) token holdings — 2,057 BAD swapped for 3.2 ETH via MetaMask. Developer Kaal Dhairya confirmed negotiations had failed and stolen assets had been moved.

CoinSpeaker; The Crypto Basic

14 October 2025

Shibarium reactivated the Plasma Bridge for BONE with mandatory seven-day withdrawal delay and proactive blacklist function. Security validated by Hexens. Compensation plan for approximately 1,200 affected wallets announced but not yet distributed.

TronWeekly; The Crypto Basic; Blockonomi; Bitget News
Provenance & Audit Trail

Decision Log

This investigation is cryptographically anchored to the Solana blockchain (1 event). 18 of 20 cited source URLs have an Internet Archive snapshot.

model: claude-sonnet-4-6

generated: 9/24/2026, 12:05:48 PM

last updated: 9/24/2026, 4:22:31 PM

avoid.net — verified advice for a post-truth world