Shibarium Bridge hack — September 2025

Shibarium, the Ethereum layer-2 network operated by the Shiba Inu project, lost control of its bridge to Ethereum in September 2025. The project's own developer report, published by core developer Kaal Dhairya, dates the incident to 12 September 2025 at 18:44 UTC; most press coverage dates it to 13 September, when it became public.

The Shiba Inu team described the mechanism as short-lived stake amplification combined with malicious checkpoint and exit proofs used to authorise withdrawals. Independent reporting adds that the attacker held signing power for 10 of the network's 12 validators and borrowed 4.6 million BONE through a flash loan to push the associated stake past the two-thirds threshold needed to sign a fraudulent checkpoint to Ethereum, which then released bridge assets. The team stated the protocol code itself was not broken, saying the issue came from stolen validator keys used to push a fake state, and said it was investigating whether the keys were taken from a server or a developer machine.

The figures are contested. Reporting that counts only the assets the attacker moved and could sell — 224.57 ETH and 92.6 billion SHIB — puts the loss near $2.4 million. Totals of up to $4.1 million circulate because they include KNINE and ROAR holdings that were largely neutralised. K9 Finance DAO blacklisted roughly $700,000 of KNINE, and the flash-borrowed 4.6 million BONE was immobilised at the stake-manager level; the team said more than $1 million of targeted assets was secured. Validator signers were rotated to multi-party hardware custody, staking was paused, and Hexens, Seal 911 and PeckShield were engaged for forensics. No attacker has been named.