On September 12, 2025 at 18:44 UTC, an attacker compromised 10 of Shibarium's 12 validator keys and used a 4.6M BONE flash loan delegated to Ryoshi Validator 1 to push past the two-thirds threshold, then co-signed a false L2 state and drained 17 tokens worth ~$4.1M from the canonical bridge. The dev team suspects key exposure from a developer machine or the server's KMS.