Shibarium cross-chain bridge suffers "complex" flash loan attack, losing $2.4 million

Jinse Finance reported that the Shibarium cross-chain bridge, which connects the Layer2 network Shibarium with Ethereum, suffered a flash loan attack on Friday, resulting in the theft of approximately $2.4 million worth of ETH and SHIB. As a result, Shiba Inu developers have restricted certain activities on the network. The attacker took out a flash loan of 4.6 million BONE (Shibarium’s governance token, down 16.32%) and appeared to have obtained 10 out of 12 validator signing keys, thereby gaining two-thirds majority control. Subsequently, the attacker used this privilege to extract about 224.57 ETH and 9.26 billion SHIB from the Shibarium cross-chain bridge contract, transferring the funds to their own address. The total value of these funds is currently around $2.4 million. In response to the attack, Shiba Inu developers suspended staking and unstaking functions on the network, effectively freezing the borrowed BONE tokens (which were already in an unstaking delay period), thus preventing the attacker from further manipulating the network. In addition, the attacker also obtained about $700,000 worth of K9 (KNINE) tokens (related to K9 Finance). When the attacker attempted to sell KNINE, the K9 Finance DAO intervened and blacklisted the attacker’s wallet address, making it impossible for these tokens to be sold.