What happened
On February 29, 2024, control of Shido's Ethereum staking contract passed to an unknown address, which upgraded the contract and withdrew all 4,353,473,223.864904 staked SHIDO, close to half of the roughly 9 billion circulating supply. The tokens were nominally worth about $35 million, but the dump crashed SHIDO by around 94% within 30 minutes, so realised losses were far smaller.
The attacker sold part of the haul for ETH and sent 692.8 ETH (about $2.4 million) to 0x4621e0cd8c91ecf1b0efcbf07f0838a5ee25c5dd. Remaining SHIDO stayed in the new owner address 0x1982358c84da9d0b4b96fc9e8564d132f7d0041f; reports value it between $1.2 million and $1.6 million. Web3 Is Going Great puts total ETH proceeds at about 956 ETH ($3.3 million). PeckShield flagged the sudden owner transfer. ZachXBT traced the attacker's funding through Layerswap and Arbitrum to a wallet that itself appeared to have been hacked.
Shido said it had secured the platform, promised stakers their assets back and asked the attacker to negotiate a bounty. Ownership transfer transaction: 0xaa76ea503fadddf775b1ef7f195676440fdc3ac46ab642798ab6fa7ae3aafcbe.
How it happened
- At 03:02 UTC on February 29, 2024, the existing owner address
0xc91E2C179461d03b277bCf5d95EdbF844DDbd408calledtransferProxyOwnership(), handing the staking proxy to0x1982358c84da9d0b4b96fc9e8564d132f7d0041f. - The new owner immediately upgraded the
StakingV4Proxyimplementation to code containing a hiddenwithdrawToken()function. - Calling
withdrawToken()pulled the contract's entire balance of 4,353,473,223.864904 SHIDO. - The attacker swapped part of the SHIDO for ETH, crashing the price about 94%, and moved 692.8 ETH to
0x4621e0cd8c91ecf1b0efcbf07f0838a5ee25c5dd.
Protocol details
Evidence
- report @CyversAlerts incident report twitter.com
- transaction Etherscan transaction 0xaa76ea50...afcbe etherscan.io
- analysis Shido token plummets 94% as exploiter drains Ethereum staking contract cointelegraph.com
- analysis DeFiLlama defillama.com
- analysis Shido token dives over 90% after Ethereum staking contract exploit crypto.news
- analysis Shido exploited for at least $3.3 million web3isgoinggreat.com
- analysis Shido Token Plummets 94% as Hacker Drains Staking Contract cryptotimes.io
- analysis SHIDO Network suspected of running away, selling SHIDO for 692 ETH (MetaTrust alert) bitget.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
