Shiba Inu’s core development team is escalating its response to the Shibarium bridge exploit after a new on-chain investigation mapped the hacker’s Tornado Cash laundering trail to KuCoin deposit accounts. Reacting to on-chain sleuth Shima (@MRShimamoto) on X, core developer Kaal Dhairya wrote “Great work! This needs to be amplified. I will also ensure it’s sent to the FBI attached to the open investigation report and request Kucoin to cooperate.”

Shiba Inu Sleuth Exposes Shibarium Hacker

The Shibarium bridge was exploited in mid-September in an attack estimated at around $2.3–$2.4 million, after the perpetrator seized a super-majority of validator keys and withdrew assets including ETH, SHIB and KNINE. K9 Finance DAO, Shibarium’s liquid-staking partner, launched a bounty process that started at 5 ETH, later advanced to a 20 ETH smart-contract offer and ultimately to a final 25 ETH proposal endorsed directly by the Shiba Inu team. The exploiter never accepted, and K9 Finance has since confirmed that the unclaimed ETH in the bounty contract has been returned to contributors, with Shib.io receiving back 20 ETH.

In a detailed 1 December thread, Shima said the “Shibarium Bridge hacker foolishly chose not to accept the K9 bounty – it’s finally time to share the investigation we’ve been working on,” describing months of tracing that involved thousands of transactions and 111 wallets. His reconstruction shows 260 ETH flowing from exploit-linked wallets into Tornado Cash, with 232.49 ETH ultimately reaching KuCoin through 48 deposits into 45 unique KuCoin deposit addresses, which he believes are largely operated by money mules rather than the hacker directly.

According to his write-up and an accompanying MetaSleuth dashboard, the trail begins with the original exploit address and nine “dumping” wallets. Those wallets received the stolen tokens, liquidated them gradually for ETH over roughly a week, and sent a total of 260 ETH into Tornado Cash. Of that amount, 250 ETH entered the mixer’s 10-ETH pool and 10 ETH the 1-ETH pool in an attempt to break on-chain linkability between the hack and any later withdrawals.

The critical breakthrough, Shima says, came about forty days after the exploit. A wallet already tied to the hacker cluster sent exactly 0.0874 ETH to what was intended to be a clean Tornado withdrawal wallet. That minor top-up, he describes as “one stupid mistake” that “completely unravelled their Tornado Cash laundering,” because it established a direct on-chain connection between the exploit side of the graph and a supposedly anonymous post-mixer address. From that contaminated node he was able to work outward, clustering multiple Tornado withdrawal wallets, intermediaries and final KuCoin “funnel” wallets.

Shima reports that each funnel wallet typically routes funds to two KuCoin deposit addresses, creating a final cluster of 45 KuCoin endpoints and roughly two dozen depositors that he argues can be treated as money-mule cash-out accounts. He says the full address list, transaction graph and methodology were first shared privately with the Shibarium team so they could approach law enforcement and KuCoin while any funds remained within reach. However, he recounts that KuCoin’s fraud desk insisted on receiving a formal law-enforcement case number before acting on the evidence.

The official ShibariumNet X account has now publicly backed the research: “Thanks to @MRShimamoto for doing all the hard work here to compile this thread. We truly appreciate your diligence and methodical approach. Hopefully this investigation can continue with the help of the proper authorities. The communities need answers.”

At press time, Shiba Inu (SHIB) traded at $0.00000878

According to reports, it has been three months since the Shibarium Bridge hack that drained more than $3 million from users, yet the case has not moved into formal law enforcement channels.

On-chain investigators traced a clear path of funds, and community members say the clues are strong enough to support an official probe. Still, exchanges are holding back unless a police case number is presented.

On-Chain Trail Revealed

Based on reports from on-chain sleuths, the attacker moved 260 Ether through Tornado Cash before routing 232.49 ETH to deposit addresses at KuCoin. The laundering path involved 111 wallets and 45 unique KuCoin deposits, according to a public breakdown by a community investigator known as Shima.

Shibarium Bridge hacker foolishly chose not to accept the K9 bounty – it’s finally time to share the investigation we’ve been working on… this is juicy

The hacker made one stupid mistake and it completely unravelled their Tornado Cash laundering.

That one mistake… pic.twitter.com/itxsXbbGSm

— Shima 島。 (@MRShimamoto) December 1, 2025

A small mistake — a single transfer of 0.0874 ETH — linked otherwise hidden wallets and allowed the investigator to map much of the operation. The tracing work was shared with the Shiba Inu ecosystem team so it could be used to press for recovery.

Why didn’t https://t.co/OoTvg1kraL call the police?

Why isn’t there a report to the appropriate authorities to get a case number?

Why have no law enforcement been involved in the https://t.co/OoTvg1kraL bridge hack? https://t.co/88Gdxi0rhh

— Pulse Digital (@CryptoPulse9) December 1, 2025

Practical Roadblocks To Recovery

Tracing crypto through mixers remains difficult, even when the ledger gives clues. Exchanges often need subpoena power, legal requests or a case number to share account details.

That requirement can leave strong on-chain leads stuck if a project does not file a police report. Community investigators can point the way, but many of the next steps depend on formal legal action and cross-border cooperation.

Exchange Action Hinges On Case Number

After Shima handed the findings to the project team, members of the community and teams such as K9 Finance stepped in. One representative, using the handle DeFi Turtle, reached out to KuCoin to ask that the exchange freeze the suspected funds.

KuCoin replied that it would require a formal law enforcement case number before taking such action, based on the messages that have circulated in community channels. Without a police report, the exchange said it could not legally provide internal records or lock the linked accounts.

Sleuth Offers Evidence To Victims

Faced with slow institutional movement, Shima has offered the full dataset, the mapping work and the methodology to victims and to any law enforcement body willing to act. Victims in different countries may need to lodge complaints locally to create the case numbers that exchanges demand.

Calls For Formal Complaints

Shane Cook, founder of Pulse Digital Marketing, questioned why the Shiba Inu team had not filed an official complaint despite the on-chain evidence. Reports show the team previously confirmed the breach and said it had contacted security firms including PeckShield and Hexens.

Cook’s criticism centers on the idea that technical analysis alone may not be enough; a legal filing is often required to make exchanges cooperate. The community now wonders whether the project prioritized reopening the bridge and repayment planning over pursuing legal routes.

Featured image from Hacked.com, chart from TradingView