Key Insights:

• Shibarium, the layer-2 network for Shiba Inu, experienced a systematic exploitation, resulting in an attacker seizing control of a validator and depleting about $3 million in assets.
• The attacker leveraged a flash loan to acquire 4.6 million BONE tokens, obtaining majority control of validator access.
• In response, the Shibarium team has halted all staking operations, transferred funds to a secure hardware wallet, and initiated an internal investigation while proposing a potential agreement with the attacker.

The attack occurred when the perpetrator, Kaal Dhariya, utilized a flash loan to purchase a substantial amount of BONE, which is the governance token for Shiba Inu’s network. By gaining access to validator signing keys, the attacker secured majority validator authority, leading to a fraudulent state being signed and assets being siphoned from the Shibarium bridge, which connects it to Ethereum.

With the BONE mostly staked, the funds are locked, providing developers a limited opportunity to respond and secure the assets. The Shibarium team, now working with security firms, has reached out to law enforcement while also extending a peace offering to the attacker, stating they’d refrain from pursuing charges if the funds are returned, and are open to considering a minor bounty.