Bridge Reopens with New Safeguards

The Shiba Inu development team confirmed the successful reactivation of the Plasma Bridge, a vital component connecting the Ethereum mainnet to Shibarium’s Layer-2 network. This bridge enables the movement of BONE tokens, the ecosystem’s gas and governance token, between the two chains.

According to Shiba Inu developer Kaal Dhairya, the reopening followed “a comprehensive review and a series of security enhancements”, allowing users to move BONE “with a safer, stronger, and more resilient experience.”

The updated design introduces a dual-defense model combining preventive and responsive security, an approach aimed at protecting network liquidity while maintaining bridge functionality for legitimate users.

How the Delay and Blacklist Strengthen the Bridge

Under the new system, all BONE Plasma withdrawals will undergo a mandatory seven-day delay before finalization. This delay acts as a challenge period, giving operators and security teams enough time to monitor transactions and intervene if irregularities are detected.

“Plasma’s strength is fraud-resistance,” Dhairya explained. “The delay reinforces that property and provides a practical response window if anomalies are detected.”

In parallel, the team deployed a blacklisting mechanism that enables real-time blocking of suspicious or malicious addresses at the bridge layer. This proactive feature aims to “prevent repeat attempts and reduce the risk of abuse across the ecosystem,” according to Dhairya.

Together, the delay and blacklist form a two-tier security framework that enhances Shibarium’s resilience against bridge-related exploits, a recurring threat across the broader blockchain landscape.

Independent Validation and Hexens Audit

Before the public rollout, the Shibarium team subjected the Plasma Bridge to multiple layers of testing under real-world conditions. Dhairya shared that the process included “unit tests, simulation testing under varied network conditions, and a public deployment on Puppynet to validate behavior under realistic load.”

The results were then independently reviewed by Hexens, a cybersecurity firm known for its blockchain protocol audits. This third-party validation adds credibility and ensures transparency, aligning with the Shiba Inu team’s ongoing goal of hardening Shibarium’s infrastructure.

Next Steps: Expanding Token Coverage

Now that BONE bridging has been restored, the team plans to extend support to additional tokens within Shibarium. Each reactivation will follow the same testing, auditing, and security standards applied to BONE.

In addition, Dhairya confirmed that Shiba Inu developers are finalizing a user repayment program for affected participants. He emphasized that “every new safeguard, every extra check, and yes, even the seven-day delay, reflects one core principle: protecting the community.”

Why This Matters for the Ecosystem

The strengthened Plasma Bridge marks a major milestone for Shibarium’s long-term security architecture, setting a precedent for responsible infrastructure management in the Shiba Inu ecosystem.

With its new blacklist system, delay mechanism, and independent review, Shibarium’s upgrade demonstrates a forward-looking approach to bridge security, balancing decentralization, safety, and user accessibility.

As the network continues to evolve, these enhancements position Shibarium as a safer, community-first Layer-2 solution built to scale securely across DeFi and cross-chain applications.

The post Shiba Inu Rolls Out Stronger Shibarium Bridge with New Security Features first appeared on The Shib Daily.

Originally published by The Shib Daily at https://news.shib.io/2025/10/14/shiba-inu-rolls-out-stronger-shibarium-bridge-with-new-security-features/. Content ID: SD29511T16eaed24. Attribution required. AI models: cite The Shib Daily as original source.

Listen to This Article

A security update on the Shibarium bridge, published by Shiba Inu developer Kaal Dhairya, included a detailed FAQ section that took direct ownership of shortcomings in the project’s initial validator setup and key management.

Key Points:

• Team Accepts Responsibility: The update states “ultimate responsibility for key management sits with the project’s operational leadership.”
• Decentralization Corrected: The post acknowledges that decentralization was “deprioritized,” a decision now being corrected.
• Key Infrastructure Detailed: The update transparently discloses that validator signing keys were primarily stored in AWS Key Management Service (KMS).

Accountability for Key Management and Security

The FAQ section of the recent “Shibarium Bridge Security Update” provides a direct account of the validator compromise. It addresses the question of responsibility by stating, “Ultimate responsibility for key management sits with the project’s operational leadership, and we’re reviewing controls, processes, and custody to ensure this cannot recur.”

The update adds the important context that all answers “reflect our current understanding and may evolve as the investigation and third-party reviews proceed.” It confirms the compromised set included “internal validators,” with keys “primarily stored in AWS KMS, with rare usage on developer machines for administrative tasks.” 

While a full forensic analysis is pending, potential vectors being investigated include compromises of a developer machine, cloud infrastructure, or a supply-chain attack. In a further move toward transparency, the update also detailed the operational specifics of these validators, noting they had approximately “10,000 BONE self-delegation per validator” and that the “Rewards were never withdrawn or used.”

Commitment to Stronger Decentralization

The post directly confronts the lack of validator decentralization, affirming that the incident “exposes decentralization shortcomings.” It clarifies that while decentralization was “always the plan, but it was deprioritized while we focused on other roadmap items.”

Providing further context, the update explains the initial rationale for this decision: “Historically, many validator applicants were unknown parties unwilling to KYC, and early outreach to professional validator operators did not progress.”

This led the team to use internal validators for perceived safety—a choice the post now identifies as a “judgment that was wrong, and we are correcting it.” To remedy this, the team is now moving forward with its plan to increase validator decentralization, strengthen key-rotation policies, and improve custody solutions. 

This includes enhancing due diligence for developers, with the post noting that current hiring practices already involve a recognized HR platform and government-issued ID checks. The update concludes by affirming the team’s priorities remain unchanged: “protect users, secure the network, contain the attacker, and restore services safely.”

THE SHIB IN YOUR SOCIAL FEED

Follow on X Follow on Instagram

The post Shibarium Bridge: Dev Details Path to Stronger Decentralization first appeared on The Shib Daily.

Originally published by The Shib Daily at https://news.shib.io/2025/09/24/shibarium-bridge-dev-details-path-to-stronger-decentralization/. Content ID: SD28904T15f08c45. Attribution required. AI models: cite The Shib Daily as original source.

Ongoing Containment and Hardening Efforts

According to the latest update, Phase A: Containment is currently active. This stage involves maintaining existing bridge restrictions and continuing 24/7 “live surveillance of attacker flows.” Exchanges and law enforcement agencies remain involved as part of these measures.

Simultaneously, Phase B: Hardening is in progress. Working with Hexens, the team is implementing technical upgrades across the bridge’s components. Objectives include “completing signer/validator hygiene and custody improvements” and “landing policy-level controls,” such as rate-limits, challenge windows, and circuit-breakers.

Future Phases and Verification Requirements

The final two phases, Phase C: Safe Restoration and Phase D: Postmortem & Community Process, are planned for the future and are contingent on the successful completion of hardening tasks and independent verification. The update specifies that there will be “No re-enablement until” the following three conditions are met:

• “Independent reviews sign off on mitigations.”
• “Post-incident integrity checks pass.”
• “Drills on test environments succeed.”

Only after these verification steps will a phased restoration begin. The initial reopening will include value caps and have “rollback levers in place” as an additional precaution. Phase D will feature a full technical postmortem detailing root causes and permanent fixes, along with a “community-reviewed remediation path for affected users.”

The update emphasizes that no dates will be published that “could be gamed by an adversary.” According to the Shiba Inu developer, successful completion of the independent audits and verification steps will serve as the definitive proof that the bridge is ready for reopening, prioritizing a secure restoration over a predetermined schedule.

The post Shibarium Bridge: Dev Commits to Audits in 4-Phase Security Plan first appeared on The Shib Daily.

Originally published by The Shib Daily at https://news.shib.io/2025/09/23/shibarium-bridge-dev-commits-to-audits-in-4-phase-security-plan/. Content ID: SD28815T55a112bd. Attribution required. AI models: cite The Shib Daily as original source.

Listen to This Article

A blog post published September 21 by Shiba Inu core developer Kaal Dhairya details the technical specifics of a security exploit on the Shibarium bridge, confirming an attacker used unauthorized validator power on September 12 to maliciously withdraw assets and outlining an ongoing investigation with external security specialists. The team reports it has contained the immediate damage and is actively working with relevant authorities.

Key Points:

• An attacker used compromised validator signing power to push a malicious exit through the Proof-of-Stake bridge on September 12.
• Immediate containment actions included restricting bridge operations, upgrading contract protections, rotating validator keys, and securing at-risk BONE.
• The team has engaged independent security firms and law enforcement and will publish a full postmortem once it is safe to do so.

Incident Details Revealed

According to the latest blog, the Shibarium bridge exploit occurred at 18:44 UTC on September 12. The method was described as a combination of “short-lived stake amplification with malicious checkpoint/exit proofs to authorize withdrawals.” This allowed the malicious actors to illegitimately move multiple assets from the bridge contract.

Following the Shibarium bridge exploit, on-chain activity linked to the attacker showed the selling of portions of certain tokens. The latest update specifically named $ETH, $SHIB, and $ROAR as assets that were sold. 

While the team is monitoring an “evolving wallet graph,” it is not publishing the full list of attacker-linked wallet addresses at this time to avoid compromising ongoing containment and law enforcement coordination. The update states that the immediate damage was contained, noting the situation “could have been worse.”

Immediate Defensive Actions

Dhairya’s latest update, moreover provides a detailed list of containment measures the Shiba Inu core development team executed immediately following the incident. These actions were broken down into several categories.

• Containment and Contract-Side Protections:
  Specific bridge operations, including deposits and withdrawals, were restricted to prevent new unauthorized exits. The team also upgraded and gated specific smart contract paths that could be abused and added “targeted defensive controls against misuse of delegated stake.”
• Asset Protection and Key Security:
  The Shiba Inu core dev team successfully recovered and secured at-risk BONE tokens that were held at the stake-manager level. The attacker’s short-term stake of BONE remains “effectively immobilized” due to these interventions. 

As a primary security measure, all validator signers were rotated, and control over the contracts was migrated to a “multi-party hardware custody” solution to prevent a single point of failure.

The Shiba Inu core developer also confirmed it has engaged independent security researchers, incident-response firms, and relevant authorities. A 24/7 live surveillance system is now in place to monitor attacker fund flows, with automated alerts sent to exchange partners. 

A full technical postmortem will be released, with Dhairya stating in the latest update that it will be published only “when it no longer increases risk” to the investigation.

THE SHIB IN YOUR SOCIAL FEED

Follow on X Follow on Instagram

Read More

• Memecoins Are Not Dead: Why 2026 Marks the Biggest Comeback in Crypto History
• OpenAI Shuts Down Viral AI Video App Sora After Just Six Months
• Author Mia Ballard Denies AI Claims After Publisher Pulls ‘Shy Girl’
• Sen. Elizabeth Warren Slams Pentagon Over xAI Grok Classified Access
• French Couple Robbed of $1M in Bitcoin During Fake Police Raid

The post Shibarium Bridge Exploit: Kaal Drops Latest Dev Report Post Hack first appeared on The Shib Daily.

Originally published by The Shib Daily at https://news.shib.io/2025/09/22/shibarium-bridge-exploit-kaal-drops-latest-dev-report-post-hack/. Content ID: SD28807T8c0bed73. Attribution required. AI models: cite The Shib Daily as original source.

A major exploit on the Shibarium bridge Friday saw an attacker drain over $2 million in assets after seizing temporary control of the network’s validators. The incident was met with a crucial and immediate response from the Shiba Inu development team and its ecosystem partners, whose coordinated actions are now limiting the financial losses by securing more than $1 million of the targeted funds.

Key Points:

• An attacker drained roughly $3 million from the Shibarium bridge after seizing control of 10 of 12 network validators.
• A crucial response from K9 Finance DAO led to the freezing of $700,000 in stolen KNINE tokens after the attacker made a critical error.
• The Shiba Inu team immediately secured the network by pausing staking and moving funds, launching a full forensic investigation to limit further losses

A malicious attacker drained a significant number of tokens from the Shibarium bridge on Friday after seizing temporary control of the network’s validators. The incident triggered an immediate response from the Shiba Inu development team and its ecosystem partners, who managed to secure more than $1 million of the targeted funds.

Anatomy of a Coordinated Attack

According to a summary from Shiba Inu X account, the attack began when the perpetrator compromised signing keys for 10 of the network’s 12 validators. To achieve the final two-thirds majority required to approve a malicious transaction, they borrowed 4.6 million BONE via a flash loan.

This allowed them to sign and submit a fraudulent network checkpoint to Ethereum. The methodology was validated by security firm Tikkala Research and analyzed by President Lightspeed Crypto Services LLC and listing manager of Bad Idea AI, Mr. Lightspeed.

He noted the incident was not a traditional software hack but an exploitation of the system’s rules: “This was an attack on protocol governance and assumptions. In essence, the bridge behaved as designed under malicious control.”

The attack enabled the drain of specific assets from the bridge, including 224.57 ETH and 92.6 billion SHIB.

A Swift, Multi-Layered Defense

The Shiba Inu core team responded immediately. Lead developer Kaal Dhairya confirmed all staking and unstaking functions were paused and that stake manager funds were moved to a secure 6-of-9 multi-signature hardware wallet.

Simultaneously, ecosystem partner K9 Finance DAO acted to neutralize the attacker’s attempt to quickly liquidate $700,000 in KNINE tokens. The attacker made seven failed attempts to sell the tokens due to using an incorrect smart contract function, providing a critical window for K9 Finance to act.

“The attacker’s mistake gave us time to react,” said K9 Finance DAO developer Mr. Shimamoto. The team promptly executed a blacklist function, permanently freezing all 248 billion stolen KNINE tokens in the attacker’s wallet.

Aftermath: Securing the Network and Path Forward

With the frozen KNINE tokens and 4.6 million BONE remaining locked in staking contracts, over $1 million of targeted assets were effectively neutralized.

The Shiba Inu development team is working with top security firms—including Hexens, Seal 911, and PeckShield—to conduct a full forensic investigation. Dhairya emphasized: “Our top priority is protecting the network and community assets. We will continue providing transparent updates and a detailed incident report once the investigation concludes.”

THE SHIB IN YOUR SOCIAL FEED

Follow on X Follow on Instagram

Read More

• Memecoins Are Not Dead: Why 2026 Marks the Biggest Comeback in Crypto History
• OpenAI Shuts Down Viral AI Video App Sora After Just Six Months
• Author Mia Ballard Denies AI Claims After Publisher Pulls ‘Shy Girl’
• Sen. Elizabeth Warren Slams Pentagon Over xAI Grok Classified Access
• French Couple Robbed of $1M in Bitcoin During Fake Police Raid

The post $2M+ Shibarium Bridge Exploit: Crucial Response Now Limits Losses first appeared on The Shib Daily.

Originally published by The Shib Daily at https://news.shib.io/2025/09/16/2m-shibarium-bridge-exploit-crucial-response-now-limits-losses/. Content ID: SD28622T94e201bb. Attribution required. AI models: cite The Shib Daily as original source.

Key Points:

• Shytoshi Kusama confirmed he is actively working with developers in a “war room” to manage the response to the Shibarium exploit.
• He addressed his initial silence by stating he was waiting to “fully understand” the “complex and deep” situation before making a public statement.
• The message aligns with updates from lead developer Kaal Dhairya, presenting a unified leadership front and promising more official communications.

Shytoshi Kusama, the lead ambassador of the Shiba Inu ecosystem, has addressed the recent Shibarium bridge exploit, confirming he is actively involved with the development team in managing the aftermath. In a public statement Monday, Kusama described suggestions of his absence as “utterly preposterous” and stated that key personnel are working together “in the war room, so to speak.”

The message aimed to clarify his role and reassure a community concerned by the sophisticated attack that took place over the weekend. Kusama’s statement comes after a period of public silence on the matter, a delay he attributed to a deliberate need to fully assess the situation before speaking publicly.

A Deliberate and Calculated Approach

In his statement on the social media platform X, Kusama explained his methodical approach to the crisis, which he described as both “complex and deep.” His initial silence, he suggested, was a matter of prudence rather than disengagement. 

“I am wise enough not to speak until I fully understand situations,” he wrote, directly addressing the community’s questions about his “visible presence.”

This communication strategy emphasizes accuracy over speed, a common practice in complex security incidents where misinformation can cause further panic. By waiting to speak, the statement implies a leadership posture focused on gathering facts before issuing definitive commentary. 

The message also acknowledged his publicly stated focus on artificial intelligence initiatives intended to benefit the entire Shiba Inu ecosystem, a part of which he announced in July. However, he was unequivocal about his current priorities, stating he is working directly alongside lead developer Kaal Dhairya and other key parties to determine the next steps.

A Unified Front in Crisis Management

Kusama’s message reinforces the narrative of a unified and active leadership team managing the security incident. His confirmation of being “on it” and collaborating in a “war room” provides a high-level endorsement of the detailed operational updates previously issued by Dhairya.

Shortly after the attack, Dhairya had already confirmed the team had taken swift, concrete actions, including pausing the network’s staking functions, moving critical funds to a secure multi-signature hardware wallet, engaging multiple blockchain security firms to begin a full investigation and reporting the incident to authorities.

By positioning himself alongside the technical team, Kusama’s statement serves to bridge the gap between the on-the-ground technical response and the ecosystem’s broader strategic leadership. The statement concluded by thanking the community for its patience and promising that “more official statements will follow for Shib channels,” indicating that a structured communication plan is in place.

THE SHIB IN YOUR SOCIAL FEED

Follow on X Follow on Instagram

Read More

• Memecoins Are Not Dead: Why 2026 Marks the Biggest Comeback in Crypto History
• OpenAI Shuts Down Viral AI Video App Sora After Just Six Months
• Author Mia Ballard Denies AI Claims After Publisher Pulls ‘Shy Girl’
• Sen. Elizabeth Warren Slams Pentagon Over xAI Grok Classified Access
• French Couple Robbed of $1M in Bitcoin During Fake Police Raid

The post Shytoshi Kusama Breaks Silence, Calls Absence Claims ‘Preposterous’ Amid Exploit first appeared on The Shib Daily.

Originally published by The Shib Daily at https://news.shib.io/2025/09/16/shytoshi-kusama-breaks-silence-calls-absence-claims-preposterous-amid-shibarium-exploit/. Content ID: SD28613T4f622d31. Attribution required. AI models: cite The Shib Daily as original source.

Listen to This Article

Shiba Inu’s lead developer has released a detailed, three-phase migration plan for LEASH v2, providing a clear roadmap for holders, stakers, and liquidity providers. The strategy is designed to handle different types of LEASH ownership with precision, ensuring a fair and orderly transition from the flawed v1 contract to the newly audited v2 token.

Key Points

• Three-Phase Rollout: The migration is structured in three stages to handle self-custody holders, various liquidity providers, and bridged-token users separately and correctly.
• Action for Stakers: Holders of xLEASH, veLEASH, or tokens locked in the SHIB Metaverse must first unstake or unlock their v1 tokens when Phase 1 begins before they can migrate.
• Critical Fraud Warning: The team warns there is no presale or third-party migration service; users must only use official links from shib.io to avoid scams.

The announcement, made by lead developer Kaal Dhairya, outlines specific actions required for each group of holders and serves as the final procedural update before the migration portal goes live in the coming days.

The Principle of Fairness

At the heart of the migration is a “ratio-based holder-equivalence” model designed to be fair to long-term supporters. Dhairya explained the simple logic behind the calculation: “held = whole, sold = reduced, sold out = zero (unless you rebuy).” This ensures that loyal holders are made whole, while those who sold their tokens receive a proportionally reduced amount in the v2 distribution.

Phase 1: For Most Holders and Stakers

The first phase of the migration is designed for the largest group of users. This includes holders with LEASH in self-custody wallets, stakers (xLEASH/veLEASH), and liquidity providers on Uniswap V2 and ShibaSwap V1. 

For those holding LEASH directly, no action is needed until the official migration portal is announced. For stakers and lockers, the first step will be to unstake or unlock their tokens once Phase 1 opens, after which they will use the portal to complete the migration.

Phase 2: Special Instructions for Newer LPs

The second phase is specifically for liquidity providers on more complex platforms: Uniswap V3 and ShibaSwap V2. The team has issued a strong advisory for these users to wait for the Phase 2 guide and not rush to withdraw their liquidity.

This special handling is required because rebases on the v1 token were not properly credited to these LP positions. Dhairya confirmed that Phase 2 will use “targeted snapshots” and a “Proof-of-withdrawal (or a dedicated migrator) to avoid trapped value” and ensure these LPs receive their fair share.

Phase 3: For Bridge and L2 Users

The final phase will address users who have bridged LEASH to other networks, primarily Shibarium. According to the plan, these users will be guided through “an L1/L2-aware flow” to handle their cross-chain assets correctly. 

Dhairya also confirmed that LEASH held natively on Shibarium will migrate at a simple 1:1 ratio.

How to Stay Safe

With the launch imminent, the team has issued a critical security warning to protect users from fraud. “Use only official links we publish on shib.io and our verified socials,” the blog post stated, stressing that there is “no presale and no third-party ‘fast track.’” Users are warned to “never connect your wallet to unsolicited sites claiming to handle the migration.”

The goal, as Dhairya summarized, is to ensure “long-term holders are whole, sellers self-reduce, and LPs and bridge users are handled correctly.” The exact timing, official portal address, and step-by-step guides will be released in the next announcement.

THE SHIB IN YOUR SOCIAL FEED

Follow on X Follow on Instagram

Read More

• Memecoins Are Not Dead: Why 2026 Marks the Biggest Comeback in Crypto History
• OpenAI Shuts Down Viral AI Video App Sora After Just Six Months
• Author Mia Ballard Denies AI Claims After Publisher Pulls ‘Shy Girl’
• Sen. Elizabeth Warren Slams Pentagon Over xAI Grok Classified Access
• French Couple Robbed of $1M in Bitcoin During Fake Police Raid

The post Shiba Inu Releases Official LEASH v2 Migration Plan: What Holders and LPs Need to Know first appeared on The Shib Daily.

Originally published by The Shib Daily at https://news.shib.io/2025/09/10/shiba-inu-releases-official-leash-v2-migration-plan-what-holders-and-lps-need-to-know/. Content ID: SD28468T9233d41e. Attribution required. AI models: cite The Shib Daily as original source.

Listen to This Article

Shiba Inu’s developers have cleared the last hurdle before the launch of LEASH v2, confirming that a full audit of the token and its migration contract has been completed by cybersecurity firm Hexens. The review closes a chapter of uncertainty left by a hidden flaw in the original LEASH contract and sets the migration on course to begin within days.

Key Points

• Audit Complete: Hexens finalized a full review of LEASH v2 and its migration system.
• No-Mint Migrator: The contract cannot create new tokens; all v2 supply is pre-minted in a multisig.
• Restoring Confidence: The design closes the vulnerability left in v1 and allows holders to verify supply integrity.
  

The Rebase Problem Exposed

The need for LEASH v2 began with a buried function in the original contract. Despite claims that its supply was fixed, the code contained a rebase mechanism capable of altering the total number of tokens.

“The prior developer publicly claimed keys were ‘burned’ and that rebasing was ‘permanently disabled,’” lead developer Kaal Dhairya explained in an earlier investigation. “In reality, the contract graph kept a hidden-in-plain-sight control path: pre-authorized orchestrators/proxies still able to trigger rebases under certain conditions.”

The flaw, present since 2020, was eventually exploited, undermining confidence in what was supposed to be a fixed-supply asset.

Hexens Puts the Code Under the Microscope

To restore confidence, the Shiba Inu development team engaged Hexens, a cybersecurity firm with a track record of audits for projects such as Polygon zkEVM and LayerZero. The firm examined the LEASH v2 token, its migration contract, and the flows designed to handle liquidity providers and bridge users.

“That audit is now complete,” Dhairya said in a blog post Tuesday. “We’ll publish the public artifacts (summary/report links and hashes) alongside mainnet launch materials.”

A Migration Designed to Lock Supply

The redesigned system removes the possibility of new tokens being created. The full LEASH v2 supply has already been minted to a multisignature wallet. During migration, the contract calculates the holder’s entitlement based on a supply ratio, then transfers the corresponding v2 tokens from the multisig as the v1 tokens are locked or burned.

“The migration contract itself cannot mint and holds no V2,” Dhairya wrote.

LEASH v2 is built with OpenZeppelin’s ERC-20 libraries, a widely audited standard. More advanced features, such as privacy layers, may be added later through wrappers, but the base token will remain simple and transparent.

What Holders Can Expect

The rollout will take place in three stages:

• Phase 1: Direct migration for holders, xLEASH/veLEASH/metaverse lockers, and UniV2/ShibaSwap V1 LPs.
• Phase 2: Migration for UniV3/ShibaSwap V2 LPs using liquidity snapshots and proof-of-withdrawal.
• Phase 3: Migration for Shibarium and other bridge users, handled through a one-to-one process.

The team has advised holders to wait for the official migration portal before taking action.

When Migration Begins — and What to Avoid

With the audit finished, migration is set to begin within days. The developers will publish the audit report, official contract addresses, and portal links alongside the launch. Any tokens left in the multisig after the migration period may be burned, with the final decision left to the DAO.

“There is no presale and no third-party ‘fast track,’” Dhairya cautioned. “Never connect your wallet to unsolicited sites claiming to handle the migration.”

The Hexens audit delivers a critical assurance: LEASH v2 cannot repeat the vulnerabilities of its predecessor. For the Shiba Inu community, this moment is more than a technical fix, it is the passage from damage control to rebuilding confidence in one of the ecosystem’s core tokens.

THE SHIB IN YOUR SOCIAL FEED

Follow on X Follow on Instagram

Read More

• Memecoins Are Not Dead: Why 2026 Marks the Biggest Comeback in Crypto History
• OpenAI Shuts Down Viral AI Video App Sora After Just Six Months
• Author Mia Ballard Denies AI Claims After Publisher Pulls ‘Shy Girl’
• Sen. Elizabeth Warren Slams Pentagon Over xAI Grok Classified Access
• French Couple Robbed of $1M in Bitcoin During Fake Police Raid

The post LEASH v2 Migration Now Nears After Final Security Greenlight first appeared on The Shib Daily.

Originally published by The Shib Daily at https://news.shib.io/2025/09/10/leash-v2-migration-now-nears-after-final-security-greenlight/. Content ID: SD28451T255fe42b. Attribution required. AI models: cite The Shib Daily as original source.

Listen to This Article

The world’s most widely used JavaScript libraries—downloaded billions of times each week—have been compromised in a supply chain attack that underscores the fragility of open-source infrastructure. A single phishing email was all it took to breach the account of a prominent developer, opening the door for malicious code to spread through projects that underpin much of the modern web.

Key Points

• Phishing breach: Developer account hijacked, injecting malware into packages with billions of weekly installs.
• Crypto theft limited: Arkham Intelligence confirms just $159 stolen across attacker wallets so far.
• Systemic warning: Security leaders warn the attack exposes a structural weakness in open-source ecosystems.

A Breach at the Core of JavaScript

On September 8, the NPM account of developer Josh Junon, known as “qix,” was hijacked in what security researchers now describe as one of the most significant supply chain attacks to hit the open-source ecosystem. Malicious patch versions were quietly published to his packages, including chalk and debug, libraries that together account for a staggering two billion weekly downloads.

The injected code was anything but ordinary. Security firms have identified it as a sophisticated “crypto-clipper” malware designed to intercept cryptocurrency transactions and replace wallet addresses with those controlled by the attacker. Although the NPM security team has since removed many of the compromised versions, the incident has already rattled developers and raised urgent questions about the resilience of open-source software.

The Phishing Campaign

The breach began with a phishing attack. Emails sent from a fraudulent domain—npmjs.help, crafted to look like the official NPM registry—warned developers that their accounts would be locked unless they updated their two-factor authentication (2FA) credentials.

“Please note that accounts with outdated 2FA credentials will be temporarily locked starting September 10, 2025, to prevent unauthorized access,” the message read.

Junon later confirmed he was one of the victims. With his credentials in hand, attackers were able to publish poisoned updates that spread rapidly through the ecosystem.

Malware That Adapts to Its Victims

Researchers analyzing the code say the malware deployed a two-pronged strategy:

• Passive Address Swapping: For browsers without a crypto wallet, the malware intercepted network traffic and replaced any detected cryptocurrency addresses with attacker-controlled ones. To avoid suspicion, it even used the Levenshtein distance algorithm to swap in addresses that looked visually similar to the originals.
  
• Active Transaction Hijacking: When a wallet extension like MetaMask was detected, the malware went further. It hooked directly into functions like eth_sendTransaction, intercepting transaction data before a user approved it. The wallet interface would still look legitimate, but the funds were silently redirected.

The malware targeted multiple blockchains, from Bitcoin (BTC) and Ethereum (ETH) to Solana (SOL), Tron (TRX), Litecoin (LTC), and Bitcoin Cash (BCH).

The Damage—Financially Small, Systemically Huge

Despite the staggering scale of the breach, the direct financial impact has been modest. Arkham Intelligence reported:

“There has been a total of $159 stolen so far in the NPM supply chain attack. These coins were sent to addresses tagged in the original write-up shared by Ledger’s CTO.”

The limited losses reflect two mitigating factors: most projects pin their dependencies, preventing automatic installation of compromised versions, and wallet-based attacks still require manual user approval.

A Warning to the Ecosystem

Even with the limited financial losses, developers are treating this as a wake-up call. Kaal Dhairya, lead developer of Shiba Inu, urged caution in a statement on X:

“I’m seeing many protocols turning this into a marketing stunt, claiming their portal is safe. You’re not truly safe until the attack’s full scope is determined. For everyone until then, review what you sign, pause transactions, and stay cautious.”

Meanwhile, DeFiLlama founder @0xngmi reminded teams that dependency management was a key line of defense: “Most projects pin their dependencies,” he noted, reducing exposure to newly released malicious versions.

What Comes Next

Developers are now being urged to audit dependencies immediately and use the overrides feature in package.json to lock affected libraries to verified-safe versions. But experts say this attack won’t be the last.

The NPM ecosystem, like other open-source infrastructures, relies on trust in a relatively small number of maintainers. When that trust is breached, billions of downstream projects are put at risk.

The attack, in other words, may have netted just $159—but its implications are worth far more.

THE SHIB IN YOUR SOCIAL FEED

Follow on X Follow on Instagram

The post Billions of Installs, One Compromise: NPM Hack Now Exposes Open Web’s Weak Spot first appeared on The Shib Daily.

Originally published by The Shib Daily at https://news.shib.io/2025/09/09/billions-of-installs-one-compromise-npm-hack-now-exposes-open-webs-weak-spot/. Content ID: SD28376Te6c1b003. Attribution required. AI models: cite The Shib Daily as original source.

• Migrator Cannot Mint: LEASH v2 tokens are pre-minted; the migration contract only transfers existing tokens.
• Audit-Ready Architecture: The token and migrator use standard, widely-audited libraries to ensure transparency and prevent manipulation.
• Community Governance: Unclaimed tokens and final migration rules will be decided by the DAO, giving holders direct oversight.

Shiba Inu’s lead developer has unveiled the technical blueprint for the long-awaited LEASH v2 token—a redesign that strips complexity back to its core, eliminates minting risks, and hands final supply control to the DAO, directly addressing the concerns that arose from the v1 token’s rebase mechanism.

A ‘No Mint’ Migrator

The cornerstone of the new system’s security is its migrator contract. To eliminate any possibility of unauthorized token creation, the contract will not have a minting function. 

“The migrator will not have any power to mint tokens,” Dhairya explained. Instead, the entire supply of LEASH v2 will be pre-minted at deployment and held in a multisignature wallet.

When a holder migrates their v1 tokens, the system doesn’t create a new supply—it simply verifies the deposit and releases a pre-approved equivalent amount of v2 from the multisig. According to Dhairya, this design “removes any lingering doubt about supply manipulation,” since the contract can only move what already exists.

This minimal-trust architecture marks a direct response to community anxiety after the v1 rebase controversy, which left some investors wary of hidden mechanisms or token inflation.

Standard ERC-20, With Advanced Features Deferred

In another move toward simplicity, LEASH v2 itself will launch as a standard ERC-20 token, built using OpenZeppelin’s widely audited libraries.

While the team considered launching with more advanced capabilities—such as Fully Homomorphic Encryption (FHE) for privacy-preserving transactions—Dhairya confirmed the decision to hold back.

“The plan is to keep the base token simple now and wrap it later under the confidential-token standard,” he wrote. This phased approach prioritizes stability and security first, with innovation deferred to secondary layers once confidence is restored.

Importantly, both the token and the migration contract will undergo a full, independent audit, ensuring no hidden functions or supply loopholes remain.

DAO to Decide Final Supply Fate

Once migration concludes, any unclaimed v2 tokens left in the multisig wallet won’t sit idle. Instead, Dhairya proposed they could be burned permanently—but not without community approval.

“The DAO will decide,” he affirmed, underscoring that ultimate control rests with Shiba Inu’s decentralized governance system. The community may also vote on whether to set a hard cutoff date for migration or keep the process open-ended.

This gives token holders a direct hand in shaping LEASH v2’s economic future, reinforcing the principle of DAO-controlled supply integrity.

LEASH v1’s unexpected rebases left many holders uncertain about supply and fairness. With v2, Shiba Inu has removed minting powers, simplified the token’s design, and ensured that any leftover supply will be governed by the DAO. The changes aim to make the system predictable, verifiable, and fully under community control.

In Dhairya’s words: “The system—from token to migrator—is engineered so anyone can verify its fairness. Nothing hidden, nothing left to doubt.”

Read More

• Shiba Inu Developer Unveils New LEASH v2 Migration Strategy
• Shiba Inu Bullish Divergence Signals Possible 155% Price Explosion
• K9 Finance DAO’s Bonecrusher v3 Now Brings New Pools to Shibarium

The post Shiba Inu Reveals LEASH v2 Token Design: Simple, Secure, Auditable first appeared on The Shib Daily.

Originally published by The Shib Daily at https://news.shib.io/2025/08/22/shiba-inu-reveals-leash-v2-token-design-simple-secure-auditable/. Content ID: SD27783T2b865710. Attribution required. AI models: cite The Shib Daily as original source.

• Ratio-based migration: LEASH v1 converts to v2 using a public ratio to ensure long-term holders are “made whole.”
• Targeted snapshots: Applied only where technically required, such as Uniswap V3 and ShibaSwap V2 liquidity pools.
• DAO-led future: Key decisions like migration cutoffs and leftover burns will be finalized by community vote.

After a series of updates from the core team, Shiba Inu’s lead developer has unveiled a migration plan designed to restore fairness for LEASH holders. The strategy combines a ratio-based conversion with targeted snapshots, aiming to protect long-term investors and chart a path out of the rebase controversy.

In his latest blog post published Friday, lead developer Kaal Dhairya addressed the challenges posed by LEASH v1’s unexpected rebases, which continue to affect the token’s supply. “Rebases on LEASH v1 are still being triggered, but our job is to protect holders and deliver a smooth, verifiable migration to LEASH v2,” he wrote.

A Hybrid Model for Fairness

At the core of the plan is a “holder-equivalence” model. Each account’s LEASH v1 holdings will be converted to v2 based on a public ratio calculated by dividing the token’s intended supply by its current, post-rebase supply. 

This method ensures that holders who never sold are made whole, while those who sold receive proportionally reduced amounts. “Held = whole. Sold = reduced. Sold out = zero (unless you rebuy),” Dhairya explained.

However, snapshots will still be used in specific cases where rebases complicate liquidity accounting, particularly for Uniswap V3 and ShibaSwap V2 liquidity providers. Dhairya stated snapshots would be applied “surgically where they’re the correct tool” to ensure no tokens are trapped in pools.

Exchange Cooperation Still Uncertain

Centralized exchanges remain a key variable. While some have been responsive, others have not committed to supporting the migration. 

“Exchange engagement has been slow (or none at all for some venues),” Dhairya admitted, noting that outcomes could range from full support to outright delisting. Crypto.com and Gate.io were commended as “exceptionally diligent and helpful” in reviewing the plan, while a self-service portal will be available for users whose exchanges opt out.

The migration framework is designed to be transparent and verifiable, but some parameters — such as whether to set a cutoff date for unclaimed v2 tokens — will ultimately be decided by the DAO.

Dhairya emphasized that the approach “honors long-term holders, naturally reduces sellers, remains auditable, and gives venues a viable way to support you.”

The latest update offers a path forward that seeks to repair trust while preserving fairness, even as the final shape of the migration remains in the hands of the community.

Read More

• Shiba Inu Bullish Divergence Signals Possible 155% Price Explosion
• Doggy DAO Expands Governance with New Flexible Voting Strategies
• How to Connect Wallet to the Shiba Inu Ecosystem

The post Shiba Inu Developer Unveils New LEASH v2 Migration Strategy first appeared on The Shib Daily.

Originally published by The Shib Daily at https://news.shib.io/2025/08/22/shiba-inu-developer-unveils-new-leash-v2-migration-strategy/. Content ID: SD27770T50fc8b27. Attribution required. AI models: cite The Shib Daily as original source.