Overview
- An attacker used a single-block, flash-loan-style purchase of 4.6 million BONE to briefly gain validator control and sign a malicious state.
- The maneuver drained about $2.4 million from the bridge, including 224.57 ETH and 92.6 billion SHIB.
- Investigators report 10 of 12 validator signing keys were compromised, while validators run by K9 Finance DAO and Unification refused to sign.
- Developers paused staking and unstaking, froze the 4.6 million BONE that remains locked under staking rules, secured funds in a 6-of-9 hardware multisig, and engaged Hexens, Seal911 and PeckShield.
- Law enforcement was alerted and the team offered leniency with a small bounty for returned funds, as K9 Finance also froze an attempted $700,000 KNINE sale.