Shibarium Bridge Flash Loan Exploit (September 2025)
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·2PQhqs…dfszSummary
On September 12, 2025, the Shibarium Ethereum-to-Layer-2 bridge suffered a multi-step exploit in which an attacker acquired 4.6 million BONE tokens via flash loan, used them to seize a supermajority of validator signing power, and drained approximately $4.1 million across at least 17 token types. The Shiba Inu development team suspended bridge operations, rotated all validator keys, recovered the flash-loaned BONE, and reopened the Plasma (BONE) Bridge on October 14, 2025 with a mandatory seven-day withdrawal delay and blacklist protections; a phased user compensation plan was announced but had not been fully distributed as of the bridge reopening.
Connected Entities
1 entityNo connected entities recorded yet — this investigation is not currently linked to any other page in the index.
Timeline(6 events)
12 September 2025
Exploit executed at approximately 18:44 UTC. Attacker obtained 4.6M BONE via flash loan, delegated to Ryoshi Validator 1, achieved two-thirds validator supermajority, signed malicious checkpoint, and drained approximately $4.1M across 17 token types from the Shibarium PoS bridge.
Vibranium Audits post-incident report; crypto.news; Blockonomi13 September 2025
Shiba Inu team froze staking and unstaking functions, trapping the 4.6M BONE in Validator 1. Stake manager funds moved to 6-of-9 hardware multisig. Security firms Hexens, Seal 911, and PeckShield engaged. 4.6M BONE subsequently recovered via targeted unbonding correction.
CoinCentral; Blockonomi; crypto.news17 September 2025
Official Shiba Inu account (@Shibtoken) published community update confirming attack vector, 17 tokens affected, 50 ETH bounty offer to attacker, and confirmation that negotiations were open.
Shib on X; The Block; CCN20 September 2025
Attacker's wallet liquidated 1.01 billion SHIB for approximately 2.9 ETH, indicating active movement of stolen assets.
CoinSpeaker22 September 2025
Attacker offloaded final BAD (Bad Idea AI) token holdings — 2,057 BAD swapped for 3.2 ETH via MetaMask. Developer Kaal Dhairya confirmed negotiations had failed and stolen assets had been moved.
CoinSpeaker; The Crypto Basic14 October 2025
Shibarium reactivated the Plasma Bridge for BONE with mandatory seven-day withdrawal delay and proactive blacklist function. Security validated by Hexens. Compensation plan for approximately 1,200 affected wallets announced but not yet distributed.
TronWeekly; The Crypto Basic; Blockonomi; Bitget NewsDecision Log
- hash: CmYZDpm4DC8G6HjiQYTjmREhheAaqo4uCkmegdJ7AuCe
This investigation is cryptographically anchored to the Solana blockchain (1 event). 18 of 20 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 9/24/2026, 12:05:48 PM
last updated: 9/24/2026, 4:22:31 PM
avoid.net — verified advice for a post-truth world