TL;DR
The Shibarium Bridge attacker has completed a major sell-off, disposing of 2,057 billion $BAD tokens in a swap that netted just 3.19 ETH, roughly $13,759. The transaction, recorded on September 22, 2025, at 02:36 UTC, confirmed the final clearance of the exploiter’s BAD holdings. Mr. Lightspeed, President of Lightspeed Crypto Services, highlighted the significance of the swap as the last major liquidation from this stash.
After the sale, all proceeds were transferred to wallet 0x45b…0DF2a, an address repeatedly linked to prior sell-offs since the initial breach. Blockchain monitoring shows that this address has been central to the exploiter’s phased liquidation strategy, while analysts continue tracking every movement to prevent further systemic issues.
The September 12 breach affected Shibarium Bridge, resulting in more than $4 million in stolen assets including SHIB, ETH, ROAR, and BAD. Since then, the attacker has sold tokens in stages. On September 20, 1.01 billion SHIB were swapped for 2.90 ETH, and the next day, 3 billion SHIB were converted into 8.64 ETH. The exploiter also liquidated 1,000 LEASH tokens for 3.46 ETH, demonstrating a methodical approach to cashing out, leaving the ecosystem cautiously monitoring further activity.
As of now, wallet 0x45b…0DF2a holds approximately 51.16 ETH ($213,515) and 4,746 LEASH ($52,255). A secondary linked wallet, 0x3B7…511A8, keeps around 3,630 LEASH, valued at $40,075. Additional funds are spread across other wallets controlled by the attacker, making full recovery challenging but ongoing.
The Shiba Inu developers offered a 5 ETH bounty (~$23,000) to encourage fund recovery, but the attacker declined and continued liquidating assets. Security firms including Hexens, Seal 911, and PeckShield are working alongside the internal team to trace the exploit, strengthen the network, and protect users’ funds.
Lead developer Kaal Dhairya emphasized that the project remains focused on security improvements and ensuring users’ assets are safeguarded. The Shibarium Bridge remains suspended until further notice while investigations continue, and additional measures are being tested to prevent similar breaches in the future.
Also read: CleanSpark Secures $100M Coinbase Credit Line for Growth: Report