BONE Rockets 40% After Flash Loan Attack on Shibarium
Shiba Inu’s layer-2 network, Shibarium, was hit by a flash loan exploit on Wednesday, allowing an attacker to seize majority validator control, drain bridge assets, and temporarily suspend staking operations.
Shibarium developer Kaal Dhariya reported that the attacker purchased 4.6 million BONE tokens, the network’s governance token, via a flash loan. This granted access to validator signing keys and majority power on the network.
Using this control, the attacker signed a fraudulent network state and siphoned funds from Shibarium’s bridge connecting it to Ethereum. Because the BONE remains staked with an unstaking delay, the assets are still locked, giving developers a narrow window to freeze the funds.
In response, the Shibarium team paused all staking operations, moved remaining assets to a 6-of-9 multisig hardware wallet, and launched an internal investigation. The breach source—whether a compromised server or developer machine—remains unknown. Estimated losses are near $3 million.
Security firms Hexens, Seal 911, and PeckShield are assisting, and law enforcement has been notified. Dhariya also offered a conditional deal to the attacker: return the funds, and no charges will be pressed, with a possible small bounty.
The exploit triggered a market reaction: BONE initially more than doubled before settling at a roughly 40% gain, while SHIB rose more than 8%.
