Shiba Inu core developer Kaal Dhairya has issued a detailed security update following the September 12 incident that exploited validator signing power on the Shibarium PoS bridge to push a malicious state/exit and withdraw multiple assets. The post, published on September 21, 2025 outlines what happened, what has been done so far, and what will govern a phased restoration once independent reviews conclude.
The Shiba Inu core dev cautioned that, given “the sophistication of this attack,” he could not presently vouch for the safety of any existing keys, and he signaled fatigue with expectations that individual contributors could “keep it all together” without broader structural support.
Key and custody hygiene steps have involved rotating validator signers and migrating contract control to multi-party hardware custody, while live monitoring and automated alerts continue in coordination with exchanges, external security researchers, incident-response firms and relevant authorities.
The update also engages frequently asked questions about validator compromise and operational accountability. It says validator signing keys were “primarily stored in AWS KMS, with rare usage on developer machines,” and that ultimate responsibility for key management lies with operational leadership. While a single intrusion vector has not been confirmed, preliminary possibilities include a developer machine compromise, a cloud KMS compromise, exposure during an AWS-to-GCP migration, or a supply-chain attack, such as via npm.
The post acknowledges decentralization shortcomings underscored by the fact that “10 of 12 validators” signed the malicious state, and it commits to greater validator decentralization, stronger key-rotation policy, tighter custody, improved disclosures, and higher due-diligence thresholds for sensitive access.
A roadmap preview sets out four gated phases. “Containment” remains ongoing with restricted bridge functionality and live monitoring; “Hardening,” in collaboration with Hexens, includes signer/validator hygiene, policy-level controls such as rate limits, challenge windows and circuit-breakers, and deny-list extensions where technically appropriate.
Next, “Safe Restoration” will not begin until independent reviews sign off on mitigations, post-incident integrity checks pass and drills on test environments succeed, with restoration executed in phases and with rollback levers; finally, a comprehensive technical postmortem will precede a community-reviewed remediation path for affected users and liquidity, with the update noting that “token-specific approaches may differ.”
Timelines remain intentionally unspecified: “We won’t publish dates that could be gamed by an adversary,” the team writes, reiterating that updates will post to official channels.
The Shiba Inu developer closes by reaffirming priorities and situating communication within a disciplined cadence. “Our priorities are unchanged: protect users, secure the network, contain the attacker, and restore services safely.” The next major communication, he writes, will be the technical postmortem and a remediation proposal “once the environment is safe for full disclosure.”
At press time, Shiba Inu traded at $0.00001207.
