Shibarium Cross-chain Bridge suffered a "complex" lightning loan attack, losing $2.4 million

Huobi HTX reported that Shiba Inu cross-chain bridge connecting Layer 2 network Shibarium and Ethereum was attacked by a flash loan on Friday, with approximately $2.4 million in ETH and SHIB stolen. As a result, Shiba Inu developers restricted some activity on the network. The attacker borrowed 4.6 million BONE (Shibarium’s governance token, down 16.32%) through Lightning Loan and appeared to have acquired 10 of the 12 validator signature keys, thus gaining control of two-thirds of the majority. The attacker then used this privilege to extract approximately 224.57 ETH and 92.6 billion SHIBs from the Shibarium cross-chain bridge contract and transferred the funds to his address. The total value of these funds is currently about $2.4 million. In response to this attack, Shiba Inu coin developers suspended the pledge and unstake functions on the network, effectively freezing the loaned BONE tokens (these tokens are already in the unstake delay period), thus preventing the attackers from continuing to manipulate the network. In addition, the attacker also received about $700,000 in K9 (KNINE) tokens (related to K9 Finance). When the attacker tried to sell KNINE, K9 Finance DAO stepped in and blacklisted the attacker's wallet addresses, making these tokens impossible to sell.