- ROAR-60Negative
Shib (@Shibtoken)
Shibarium Bridge Exploit Community Update 17/09/2026 The attacker executed a flash loan swap to acquire 4.6M $BONE from Shibaswap & used those to delegate them to Ryoshi Validator 1. This gave the attacker > 2/3 majority voting on Shibarium validators & the ability to use the compromised internal validators to sign a malicious state to the chain, allowing them the steal $4.1M USD from the Shibarium bridge 17 different tokens were taken from the bridge. This included: $1m of ETH $1.3m of SHIB $717k of KNINE $680k of LEASH $260k of ROAR As well as smaller amounts of TREAT, USDC, USDT, BAD, SHIFU, FUND, DAI, LTD, XFUND, WBTC, & OSCAR The attacker only sold their USDT & USDC to ETH & they attempted 7 times to sell their KNINE before the @k9finance DAO was able to blacklist their wallet. All other tokens listed above are in control of the attacker and are at risk. The leading possibility for the root cause of the attack was a compromise of internal validator keys either from the developer machine or the server's KMS. We have suspended bridge operations, launched forensic analysis, & there is a significant loss of user funds on Shibarium. The team has now flagged all transactions and removed access to predicate of CCIP connector in cross chain contract, which initially was suspected as the point of attack. It was unrelated. Other actions include: - Revoking the root chain manager access from the POS bridge to disable the bridge - Increased half exit time of plasma bridge - Removed predicate burn only from registry in plasma to prevent withdrawals & more to be share soon. The Shib team has offered the attacker a 50 ETH bounty for the return of these stolen funds. Full details here : https://t.co/1uCqgKrpDx We will improve monitoring & alerting and continue to increase internal security practices. A full post mortem report will follow with more details.