Shibarium cross-chain bridge suffers a flash loan attack, resulting in losses exceeding 2.4 million dollars

ChainCatcher news, the Shibarium cross-chain bridge connecting Layer 2 networks and Ethereum has been hacked, resulting in a loss of $2.4 million. Developers have suspended staking, unstaking, and related processes to rotate and protect validator keys.

The attacker borrowed 4.6 million BONE tokens (the governance token of Shibarium) through a flash loan and seemingly obtained 10 out of 12 validator signing keys used to secure the network, thereby gaining a two-thirds majority. The attacker then exploited their privileged position to steal approximately 224.57 ETH and 92.6 billion SHIB from the Shibarium bridge contract and transferred these funds to their own address. At current prices, these funds are worth about $2.4 million.

In response to the attack, Shiba Inu developers suspended staking and unstaking functions on the network, effectively freezing the borrowed BONE tokens (which were already affected by unstaking delays) and causing the attacker to lose majority control. The attacker also acquired a large amount of K9 (KNINE) tokens (related to K9 Finance), worth about $700,000. When the attacker attempted to sell KNINE, the K9 Finance DAO intervened and blacklisted the attacker's address, preventing the sale of these tokens.