Shibarium Bridge Suffers 4.6 Million BONE Exploitation, Team Freezes Funds

On Saturday, Shiba Inu’s Layer 2 blockchain network, Shibarium, experienced a carefully planned attack on its bridge. But the team took a smart step to prevent the theft and announced that it had frozen 4.6 million BONE tokens. 

Attackers Borrow 4.6 Million BONE Tokens

Shiba Inu developer, Kaal Dhairya, confirmed the news on his X post (formerly Twitter). He said that the hacker planned a flash loan where they borrowed 4.6 million BONE tokens. This move gave the attackers control over key parts of the network due to compromised validator keys and also allowed them to approve fake transactions and steal funds from the Shibarium bridge. 

However, the SHIB team outsmarted the attackers and stopped them from moving the assets. Fortunately, since the BONE was delegated to Validator 1, it remains locked due to unstaking delays, giving the team a chance to freeze those funds before the attackers could succeed. 

The developer said, “Because the BONE was delegated to Validator 1, it remains locked (due to unstaking delays), giving us the chance to freeze those funds.” 

Immediate Action by Shibarium

As an immediate action, Shibarium paused the functionality of stake/unstake. The team also moved the stake manager funds out of the proxy into a hardware wallet, which is controlled by a 6/9 multisig. 

This is a temporary move by the team until full confirmation of validator key security arrives. On behalf of the Shibarium team, Dhairya wrote, “Our top priority is protecting the network and community assets. We will continue to provide transparent updates as the investigation progresses.”

The team will now secure key transfers and restore the stake manager’s funds once validator integrity is verified.

Shibarium Collaborates with Cybersecurity Team

The source of the breach has not been identified yet by the team, but investigations are ongoing. Shibarium also partnered with Hexens, Seal 911, and PeckShield, cybersecurity teams on Web3 and blockchain ecosystems. 

Moreover, the team also confirmed that it will not press any charges against the attacker and is ready to negotiate. Dhairya said, “Authorities have been contacted. However, we are open to negotiating in good faith with the attacker: if the funds are returned, we will not press any charges and are willing to consider a small bounty.”