BONE Surges 40% Following Shibarium Flash Loan Exploit

Shiba Inu’s layer-2 network, Shibarium, suffered a coordinated exploit on Wednesday after an attacker used a flash loan to gain majority validator control, siphon assets from its bridge, and temporarily halt staking operations.

According to Shibarium developer Kaal Dhariya, the attacker acquired 4.6 million BONE tokens, the network’s governance token, through a flash loan. Using the tokens, the attacker gained access to validator signing keys and achieved majority validator power.

With that control, a fraudulent network state was signed, allowing the attacker to drain funds from the Shibarium bridge linking the network to Ethereum. Because BONE remains staked with an unstaking delay, the assets are still locked, giving developers a critical window to freeze the funds.

The Shibarium team has paused all staking and unstaking functions, transferred remaining assets to a 6-of-9 multisig hardware wallet, and launched an internal investigation. The source of the breach—whether a compromised server or developer machine—remains unknown. Transaction data suggests losses near $3 million.

Developers are collaborating with security firms Hexens, Seal 911, and PeckShield, and have notified law enforcement. In a public statement, Dhariya indicated the team is open to negotiating with the attacker: if funds are returned, no charges will be pressed and a small bounty may be offered.

The market reacted sharply to the exploit. BONE initially more than doubled in value before settling at a roughly 40% gain, while SHIB rose more than 8%.