(a) Problem the project solves

Shiba Inu started as a memecoin and now presents itself as an ecosystem project. Its founder, the pseudonymous Ryoshi, described it as an experiment in decentralized spontaneous community building, and the launch solved no technical problem. The project has since built products around the token to give it a function beyond speculation. ShibaSwap launched in July 2021 as a community decentralized exchange, Shibarium launched in August 2023 as an Ethereum layer 2 that routes 70 percent of its transaction fees into SHIB burns, and the Doggy DAO system gives ecosystem token holders a vote over protocol decisions. The problem the project now addresses is the absence of any utility or supply sink in a memecoin, and it addresses it by attaching a chain, an exchange, and a governance system to the token.

(Source: Gemini Shiba Inu Guide, Crypto.com Shiba Inu Guide, Doggy DAOs Documentation, CoinStats Fundamental Analysis)

(b) Operational priorities

Shiba Inu funds operations through the ecosystem it built rather than through a token treasury allocated at launch. No portion of the original supply was reserved for the team, so no launch allocation funds development. Shibarium generates transaction fees, of which 70 percent are converted into SHIB and burned, and ShibaSwap generates trading fees. The project's operational priority for 2026 is recovery from the September 2025 Shibarium bridge exploit, which core developer Kaal Dhairya described in his 2025 year-end letter as the hardest period in the project's history, and repayment of affected users through the SOU repayment system launched in February 2026. The leadership committed in an August 2024 podcast interview to handing control of the ecosystem to the community, and Shytoshi Kusama executed the first step of that transition in January 2025 when he stepped down as the project's lead and assumed the role of lead ambassador.

(Source: Arabian Business AB Majlis, Yahoo Finance Kusama Steps Down, U.Today Devs Silence, U.Today SOU Launch)

(c) High-level project overview

SHIB is an ERC-20 token on Ethereum at contract address 0x95ad61b0a150d79219dcf64e1e6cc01f0b64c4ce with 18 decimals and 1,685,242 holders as of 2 September 2026. The pseudonymous founder Ryoshi created it in August 2020 with an initial supply of one quadrillion tokens, locked 50 percent into Uniswap liquidity and destroyed the keys, and sent the other 50 percent to Vitalik Buterin's wallet. Buterin burned more than 410 trillion SHIB in May 2021 and donated more than 50 trillion SHIB to the India Covid Crypto Relief Fund. The project now spans four ecosystem tokens, SHIB, BONE with a total supply of 250 million, LEASH with a limited supply of 107,646, and TREAT which serves as a utility and rewards token across DeFi, gaming, and NFT products. Shibarium is the project's Ethereum layer 2 and crossed one billion cumulative transactions in April 2026, ShibaSwap is its decentralized exchange, and the Doggy DAO system provides governance.

(Source: Etherscan SHIB Token, Gemini Shiba Inu Guide, Shib Daily Ecosystem Guide, KuCoin Shibarium 1 Billion, Doggy DAOs Documentation)

(d) Primary token functions

SHIB carries three functions. It transfers value between holders as a standard ERC-20 token. It carries governance weight in the Doggy DAO system, where SHIB, BONE, LEASH, and TREAT holders vote on ecosystem proposals through the ShibaSwap governance portal. It is the asset that Shibarium burns, because 70 percent of Shibarium transaction fees are converted into SHIB and destroyed. BONE rather than SHIB is the governance token for core protocol decisions, the gas token for Shibarium transactions, and the staking asset for Shibarium validators, so SHIB's governance weight sits alongside BONE's rather than replacing it.

(Source: Doggy DAOs Documentation, Shib Daily Ecosystem Guide, Shib Daily SHIB BONE LEASH, Shib Daily Doggy DAO)

(e) Control surface reliance

The SHIB token itself relies on no control surface. Its supply is fixed with no mint function, and the launch liquidity was locked into Uniswap with the keys destroyed, so no party can inflate the supply or withdraw that liquidity. The ecosystem around the token relies heavily on privileged control, and the September 2025 Shibarium bridge exploit proved how heavily. Ten of the network's twelve validator signing keys were compromised in that incident, which gave the attacker a two thirds majority over bridge state, and the keys were held primarily in AWS Key Management Service with occasional use on developer machines. In response the team rotated every validator key, migrated more than 100 mission-critical Shibarium, ShibaSwap, and Shiba Metaverse contracts to multisig hardware wallets, added a blacklist to the StakeManager contract, and restored the bridge under a seven-day withdrawal challenge period. The team published its post-mortem in October 2025 and launched the SOU repayment system in February 2026, and the stated direction is toward greater validator decentralization, stricter key rotation, and tighter custody, with a standing commitment to handing control of the ecosystem to the community.

(Source: Shib Daily Kaal Dev Report, The Block Bridge Restart, Shib Magazine Bridge Update, U.Today SOU Launch, Arabian Business AB Majlis)

Labs / DevCo

Foundation

DAO / Onchain Governance

The Shib Doggy DAO Foundation has been announced and has named advisors, and the project has not published its legal name, entity type, or a registry record confirming its formation. The project's 2023 Shibarium foundational blog proposed wrapping the DAO with a Cayman Islands foundation responsible for executing the DAO's decisions and holding the DAO's assets including the Doggy Treasury, and the project has not confirmed that the Cayman entity was formed. Alpha Transform Holdings joined the foundation as an advisor in August 2023 and supplied the three named advisors below. The project's marketing lead, Lucie, stated on 17 October 2024 that the foundation would launch soon. No director, officer, or employee of the foundation has been named.

(Source: Shibarium Foundational Blog, GlobeNewswire Alpha Transform Advisory, Bitcoinist DAO and Foundation)

(a) IP ownership & control

The Doggy DAO does not own or control the project's intellectual property. The project has not published any assignment of the Shiba Inu name, brand, code repositories, or trademarks to the DAO or to any other named holder, and no DAO vote has ever transferred an intellectual property right. The announced Shib Doggy DAO Foundation is intended to hold the DAO's assets and the Doggy Treasury, and the project has not stated that intellectual property is among those assets or that the transfer has occurred.

(Source: Doggy DAOs Documentation, Shibarium Foundational Blog, Bitcoinist DAO and Foundation)

(b) Contract/admin powers

The Doggy DAO holds no direct administrative power over the SHIB token contract, and no such power exists to hold. The SHIB contract has a fixed supply with no mint function, and the launch liquidity was locked into Uniswap with the keys destroyed. The consequential contract powers sit on Shibarium rather than on SHIB, and the DAO does not hold them. Validator signing keys are held by the operations team, and the September 2025 bridge exploit showed that control of ten of twelve of those keys was sufficient to drain the bridge. Since the exploit, more than 100 mission-critical Shibarium, ShibaSwap, and Shiba Metaverse contracts have been migrated to multisig hardware wallets, the StakeManager contract carries a blacklist that can bar an address from staking, unstaking, or claiming rewards, and the restored bridge operates under a seven-day withdrawal challenge period. The project has not published the signer identities, signer count, or threshold for those multisigs, and it has not stated that the DAO controls them.

(Source: Shib Daily Kaal Dev Report, The Block Bridge Restart, Shib Magazine Bridge Update, Bitget News Bridge Restored)

(c) Locked-token rights (conditional)

Locked and staked tokens carry governance rights in the Doggy DAO. One of the four voting strategies is staking-based voting, which grants voting weight to tokens committed to a staking contract rather than held liquid, and BONE staked to Shibarium validators is locked for the duration of the network's unstaking delay. Locked tokens therefore vote and earn staking rewards. Locked tokens carry no additional economic entitlement beyond those rewards, no redemption right, and no claim on any entity. The September 2025 exploit demonstrated the limit of that arrangement, because the attacker's flash-loaned 4.6 million BONE was frozen when the team paused staking and was later recovered through a new method added to the StakeManager contract, which means staked positions are subject to intervention by the operations team.

(Source: Shib Daily Voting Strategies, DailyCoin Doggy DAO Voting, BeInCrypto Staking Halt, Bitget News Bridge Restored)

(d) Value accrual & holder rights

SHIB holders hold governance rights and a claim on a supply sink, and no cash flow right. Holding SHIB grants voting weight in the Doggy DAO through the ShibaSwap governance portal, so holders can vote on ecosystem proposals and, with 10,000 BONE, submit one. Value accrual runs through burns rather than distributions, because 70 percent of Shibarium transaction fees are converted into SHIB and destroyed, which reduces supply as network usage grows. The project has published no dividend, no fee-sharing arrangement, and no redemption right, and SHIB confers no claim against any entity. The scale of the supply limits the burn mechanism materially, because burns measured in millions or billions of tokens run against a circulating supply of roughly 589.24 trillion as of 2 September 2026.

(Source: Doggy DAOs Documentation, Crypt Eye Burn Tracker, Shib Daily Doggy DAO, Shib Daily Ecosystem Guide)

(e) Dissolution authority

The project has not published a dissolution mechanism for the Doggy DAO, and no party has been identified as holding authority to wind it down or to distribute the Doggy Treasury on wind-up. The announced Shib Doggy DAO Foundation is intended to hold the DAO's assets and prevent misallocation, and the project has not disclosed what happens to those assets if the foundation or the DAO ceases to operate. The SHIB token cannot be dissolved by any party, because its supply is fixed, it has no owner functions, and its launch liquidity is permanently locked.

(Source: Shibarium Foundational Blog, Doggy DAOs Documentation, Gemini Shiba Inu Guide)

(a) Entity

The Shib Doggy DAO Foundation is the project's announced foundation entity. The project's 2023 Shibarium foundational blog proposed the entity as a Cayman Islands foundation whose purpose is to legally encapsulate the Doggy DAO so that community decisions are properly executed, and to hold the DAO's assets including the Doggy Treasury. Alpha Transform Holdings joined it as an advisor in August 2023, and the project's marketing lead Lucie stated on 17 October 2024 that it would launch soon alongside the new governance model. The onchain Doggy DAO went live on 29 May 2025. The project has not published the foundation's legal name or a registry record of its formation, and it has not confirmed that the Cayman Islands entity was formed.

(Source: Shibarium Foundational Blog, GlobeNewswire Alpha Transform Advisory, Bitcoinist DAO and Foundation, Crypto Basic ShibDAO Launch)

(b) IP ownership & control

The project has not disclosed any repository, code, trademark, or brand right owned or controlled by the Shib Doggy DAO Foundation, and it has not disclosed any subsidiary entities of the foundation. No assignment of the Shiba Inu name or of the ecosystem's code to the foundation has been published.

(Source: Bitcoinist DAO and Foundation, Doggy DAOs Documentation)

(c) Powers over DAO, treasury, protocol-controlled resources, and token administration

The foundation's disclosed powers run to the DAO and its treasury. It is to execute the decisions of the Doggy DAO, hold the DAO's assets including the Doggy Treasury, manage those assets, prevent misallocation, and provide security and transparency over them. The project has not disclosed the size or composition of the Doggy Treasury, the wallet addresses that hold it, whether the foundation can veto or amend a passed DAO proposal, or any voting threshold or quorum that binds the foundation. The foundation holds no disclosed power over the SHIB token contract, which has a fixed supply and no owner functions, and no disclosed power over Shibarium validator keys or the ecosystem multisigs.

(Source: Shibarium Foundational Blog, Bitcoinist DAO and Foundation, Doggy DAOs Documentation, Gemini Shiba Inu Guide)

(d) Powers over DevCo

Shiba Inu has not disclosed a development company, so the foundation holds no disclosed power over one. The project's contributors work under pseudonyms with no disclosed employing entity, and the project has not published any agreement, funding arrangement, or reporting line between the foundation and those contributors.

(Source: Arabian Business Interview, Bitcoinist DAO and Foundation)

(e) Contract/admin powers

The project has not disclosed any contract or administrative power held by the Shib Doggy DAO Foundation. No pause, upgrade, mint, blacklist, or executor role on any Shiba Inu ecosystem contract has been attributed to the foundation, and the foundation has not been named as a signer on any multisig. The more than 100 mission-critical contracts migrated to multisig hardware wallets after the September 2025 exploit were not disclosed as foundation-controlled.

(Source: Bitcoinist Security Update, Bitget News Bridge Restored, Bitcoinist DAO and Foundation)

(f) Current economic arrangements and distribution policies

The project has not disclosed any governance-approved, contractual, or programmatic mechanism that directs fees, revenue, rewards, or token distributions to the Shib Doggy DAO Foundation, to its advisors, or to its contributors. No portion of the original one quadrillion SHIB supply was allocated to a foundation, because the entire supply went to Uniswap liquidity and to Vitalik Buterin at launch. The project has not disclosed the compensation arrangements for Enzo Villani, Michael Terpin, or Seth Shapiro in their advisory roles.

(Source: Gemini Shiba Inu Guide, GlobeNewswire Alpha Transform Advisory, Bitcoinist DAO and Foundation)

(a) Entity

Shiba Inu has not disclosed a primary development company. No labs entity, development company, or other legal entity has ever been named as the employer of the project's contributors or as the developer of Shibarium, ShibaSwap, or the SHIB token, and no legal name or jurisdiction of incorporation has been published. The project's founder Ryoshi, its lead developer Kaal Dhairya, and its lead ambassador Shytoshi Kusama all operate under pseudonyms, and Kusama and Dhairya appeared for the project's first ever interview with their faces and features fully concealed. Because no DevCo has been disclosed, items (b) through (f) are answered below against that absence of disclosure.

(Source: Arabian Business Interview, Yahoo Finance Kusama Steps Down, Shib Daily Kaal Dev Report)

(b) IP ownership & control

The project has not disclosed which party owns or controls the Shiba Inu code repositories, trademarks, or brand rights. No development company has been named as the holder, and no subsidiary entities have been disclosed.

(Source: Arabian Business Interview, Doggy DAOs Documentation)

(c) Powers over DAO, treasury, protocol-controlled resources, and token administration

No development company has been disclosed, so no formal powers have been attributed to one. Practical control over protocol-controlled resources sits with the pseudonymous core team, and the September 2025 bridge exploit made the extent of that control explicit. Kaal Dhairya's post-incident report stated that validator signing keys were held primarily in AWS Key Management Service with rare usage on developer machines, and that ultimate responsibility for key management lay with operational leadership. That team rotated all validator keys, migrated more than 100 mission-critical contracts to multisig hardware wallets, added a blacklist to the StakeManager contract, and used a new StakeManager method to seize 4.6 million BONE from the attacker and remove the malicious delegation. The team also designed and deployed the SOU repayment system in February 2026, which mints an onchain record of what the ecosystem owes each affected user and pays it down from team payouts and community donations. None of those actions required a DAO vote. The team holds no disclosed power over the SHIB token contract, which has a fixed supply and no owner functions.

(Source: Shib Daily Kaal Dev Report, U.Today SOU Launch, Bitget News Bridge Restored, Gemini Shiba Inu Guide)

(d) Powers over Foundation

No development company has been disclosed, so no formal power over the Shib Doggy DAO Foundation has been attributed to one. The project has not published any agreement, board seat, appointment right, or funding arrangement linking its contributors to the foundation, and the foundation's formation has not been confirmed.

(Source: Bitcoinist DAO and Foundation, Shibarium Foundational Blog)

(e) Contract/admin powers

The project has not published the identities, count, or threshold of the signers on the multisig hardware wallets that now hold more than 100 mission-critical Shibarium, ShibaSwap, and Shiba Metaverse contracts, and it has not published who holds the rotated validator signing keys. The core team demonstrably exercises those powers, because it paused staking, restricted bridge operations, upgraded contract protections, rotated keys, and recovered the attacker's BONE in September 2025, and it restored the bridge under a seven-day withdrawal challenge period in October 2025. The SHIB token contract itself carries no pause, upgrade, mint, or blacklist role for anyone.

(Source: Shib Daily Kaal Dev Report, BeInCrypto Staking Halt, Shib Magazine Bridge Update, Gemini Shiba Inu Guide)

(f) Current economic arrangements and distribution policies

The project has not disclosed how its contributors are compensated. No portion of the original one quadrillion SHIB supply was allocated to a team, a company, or an investor, because the full supply went to Uniswap liquidity and to Vitalik Buterin at launch, so no launch allocation pays the developers. Shibarium and ShibaSwap generate transaction and trading fees, and 70 percent of Shibarium transaction fees are converted into SHIB and burned. The project has not published where the remaining fee revenue goes, and it has not disclosed any contractual or programmatic mechanism directing fees, revenue, rewards, or token distributions to its contributors.

(Source: Gemini Shiba Inu Guide, CoinStats Fundamental Analysis, Shib Daily Ecosystem Guide, Crypto.com Shiba Inu Guide)

(a) Planned but not yet executed airdrop

This sub-item does not apply. Shiba Inu has no planned airdrop, so there is no forward-looking recipient wallet list to commit to publishing quarterly.

(Source: Gemini Shiba Inu Guide, Bitstamp Shiba Inu Guide)

(b) Executed airdrop

This sub-item does not apply. Shiba Inu has never executed an airdrop, so no user segments, allocation methods, or per-address allocation source exist to disclose. The transfer of half the launch supply to Vitalik Buterin was a single unsolicited gift to one wallet rather than a distribution to a set of recipients, and it involved no claim contract, no snapshot, and no eligibility criteria.

(Source: Gemini Shiba Inu Guide, Crypto.com Shiba Inu Guide)

(c) No airdrop planned or conducted

Shiba Inu has never conducted an airdrop and has no airdrop planned. The entire launch supply of one quadrillion SHIB went to a Uniswap liquidity pool and to a single wallet in August 2020, and every SHIB in circulation since then has been acquired through open market trading. No claim contract, Merkle distributor, or eligibility snapshot has ever been deployed for SHIB.

(Source: Gemini Shiba Inu Guide, Capital.com Shiba Inu, Etherscan SHIB Token)

No market-maker name is publicly disclosed. Shiba Inu has never disclosed an agreement or a deal with any market maker. No token allocation or loaned amount to a market maker is publicly disclosed. The entire launch supply went to a Uniswap pool with the keys destroyed and to Vitalik Buterin's wallet, so no reserve was retained from which a market maker could have been funded. No duration or term is publicly disclosed, because no market-maker agreement is publicly disclosed. No agreement structure is publicly disclosed. No loan, option, call, or retainer arrangement with a market maker has been identified.

(Source: Gemini Shiba Inu Guide, Bitstamp Shiba Inu Guide, Crypto.com Shiba Inu Guide)

SHIB trades on Coinbase, Bitstamp, Gemini, Bitget, and HTX among other centralized venues, and onchain through the original Uniswap pool seeded with half the launch supply and through ShibaSwap, the project's own decentralized exchange launched in July 2021. Shiba Inu has not disclosed a listing agreement with any named venue, and each exchange listed SHIB on its own initiative. No token allocation supplied or committed for any listing is publicly disclosed. The project retained no supply at launch, so no listing reserve existed to allocate. No listing lockup term, liquidity program term, or incentive program term is publicly disclosed for any centralized venue. The Uniswap liquidity seeded at launch is locked permanently rather than for a term, because the team destroyed the keys. No listing fees paid in SHIB are publicly disclosed. No recipient, amount, percentage of supply, vesting term, or lock term tied to an exchange partnership has been published.

(Source: Coinbase SHIB, Gemini Shiba Inu Guide, HTX SHIB, Crypto.news ShibaSwap, Bitstamp Shiba Inu Guide, Crypto.com Shiba Inu Guide)

No prior token sale series exists. Shiba Inu conducted no seed round, no private sale, no public sale, and no initial exchange offering, and it raised no capital at launch in August 2020. The full supply went to a Uniswap liquidity pool and to Vitalik Buterin's wallet. No OTC sale by the project and no discounted sale to any investor has been publicly disclosed.

(Source: Gemini Shiba Inu Guide, Crypto.com Shiba Inu Guide, Bitstamp Shiba Inu Guide)

(a) Date & component affected

The attack occurred on 12 September 2025. The affected component was the Shibarium bridge, the proof-of-stake bridge through which validators confirm transactions between Shibarium and Ethereum, together with the validator set and the StakeManager staking contract that secure it. The SHIB ERC-20 contract on Ethereum was not affected, and no holder's SHIB balance outside the bridge was touched.

(Source: Crypto.news Shibarium Exploit, CoinDesk BONE Price, Shib Daily Kaal Dev Report)

(b) Exploit vector summary

The attacker combined a flash loan with compromised validator keys rather than exploiting a code defect. The attacker borrowed 4.6 million BONE through a flash loan and staked it to reach the validator thresholds used in bridge validation, and separately obtained access to 10 of the network's 12 validator signing keys, which delivered the two thirds signing majority the bridge requires. Only the two validators run by K9 Finance and Unification declined to sign the malicious state. With that majority the attacker submitted fraudulent state data to Shibarium's Ethereum-linked contracts and withdrew the bridge's assets, and the fraudulent submission triggered an automatic safety shutdown. Kaal Dhairya's post-incident report stated that the validator signing keys were held primarily in AWS Key Management Service with rare usage on developer machines, that ultimate responsibility for key management lay with operational leadership, and that a single intrusion vector was not confirmed. The candidate vectors the report named are a developer machine compromise, a cloud key management service compromise, exposure during a migration from AWS to Google Cloud Platform, and a supply-chain attack through a package registry such as npm. Analysts described the attack as targeting governance and validator mechanics rather than a smart-contract bug, and Dhairya described it as sophisticated and probably planned for months.

(Source: Shib Daily Kaal Dev Report, Cryptopolitan K9 Finance, Crypto.news Shibarium Exploit, CCN Bridge Hack)

(c) Quantified impact

The attacker drained approximately 224.57 ETH and 92.6 billion SHIB from the bridge contract and transferred the funds to an address under their control. The team's community update of 17 September 2025 placed the total theft at approximately 4.1 million dollars across ETH, SHIB, and 15 other tokens including KNINE, LEASH, ROAR, and TREAT, while contemporaneous reporting valued the initial drain at approximately 2.4 million dollars at the time of the theft. More than 1,200 wallets were affected, and K9 Finance alone lost more than 700,000 dollars in KNINE tokens, with approximately 25 percent of the total KNINE supply removed from the bridge. BONE rose sharply on the borrowed-and-frozen supply dynamics in the immediate aftermath, and the ecosystem tokens fell as the disclosure spread. No SHIB was minted or destroyed, and SHIB's total supply was unaffected.

(Source: ChainCatcher Compensation Plan, SQ Magazine Bridge Relaunch, Crypto Daily K9 Sunset, Crypto.news Shibarium Exploit, CoinDesk BONE Price)

(d) Remediation/response taken

The team's immediate containment restricted bridge operations, paused staking, and upgraded contract protections. Pausing staking froze the 4.6 million BONE the attacker had flash-loaned and limited the attacker's profit, and the team then added a new method to the StakeManager contract that let it rescue that 4.6 million BONE from the attacker's contract and remove the malicious delegation. The team rotated every validator signing key, migrated more than 100 mission-critical contracts across Shibarium, ShibaSwap, and the Shiba Metaverse to wallets governed by multi-party security procedures, added a blacklist feature so that flagged addresses cannot stake, unstake, or claim rewards, and restored the bridge in October 2025 under a seven-day withdrawal challenge period. The team engaged independent security firms and law enforcement, offered the attacker a 50 ETH bounty for return of the funds which produced no deal, published its post-mortem in October 2025, and consolidated RPC infrastructure with dRPC.org at rpc.shibarium.shib.io. In February 2026 the team launched the SOU repayment system, under which each affected user receives an SOU NFT recording onchain the principal the ecosystem owes them, with the principal paid down through payouts and community donations, and the SOU contracts were audited by Hexens before launch.

(Source: Shib Daily Kaal Dev Report, The Block Bridge Restart, Cryptonews Bridge Reboot, Shib Magazine Bridge Update, U.Today SOU Launch)

(e) Current status

The Shibarium bridge is restored and operating with the new safeguards in place, including the seven-day withdrawal challenge period. The 4.6 million BONE was recovered from the attacker's contract, and the drained 224.57 ETH and 92.6 billion SHIB were not recovered. The attacker has not been publicly identified or charged. The team published its post-mortem in October 2025, which acknowledged that 10 of 12 validators signing the malicious state was a decentralization failure. Repayment of affected users remains in progress through the SOU system launched in February 2026 and is not complete. K9 Finance DAO, whose validator was one of the two that declined to sign the malicious state, set a deadline of 6 January 2026 for full victim compensation, the deadline passed without full restitution, and a K9 governance vote resulted in the permanent sunset of all K9 Finance products on Shibarium effective 25 February 2026, with approximately 25 percent of the KNINE supply still unrecovered.

(Source: Shib Magazine Bridge Update, U.Today SOU Launch, Cryptopolitan K9 Finance, Crypto Daily K9 Sunset, The Block Bridge Restart)

(f) References (optional)

The project's own technical reporting is published on The Shib Daily and The Shib Magazine, and the October 2025 post-mortem findings are summarized by The Block. Independent reporting is available from crypto.news, CoinDesk, The Block, CCN, and Cryptopolitan, and follow-up coverage of the SOU repayment system and the K9 Finance sunset is available from U.Today and Crypto Daily.

(Source: Shib Daily Kaal Dev Report, Shib Magazine Bridge Update, The Block Bridge Restart, Crypto.news Shibarium Exploit, CoinDesk BONE Price, CCN Bridge Hack, U.Today SOU Launch, Crypto Daily K9 Sunset)

The SHIB token contract has never been exploited, and its fixed supply and absence of owner functions leave no attack surface at the token level. The ecosystem built around SHIB has been exploited once, in the Shibarium bridge attack of September 2025, and that incident is disclosed in full below.

(Source: Crypto.news Shibarium Exploit, Etherscan SHIB Token)

(a) Regulatory, Legal & Tax Risks

(a) Impact of Regulatory Change on TGE and Listings

Shiba Inu's launch in August 2020 involved no sale, no purchaser, and no proceeds, so no regulatory change can block a delivery obligation or reopen an offering. The exposure is forward-looking and falls on the ecosystem rather than on the token. SHIB depends on Coinbase, Bitstamp, Gemini, Bitget, and HTX among other venues for its liquidity, and each decides independently whether to keep the pair open. A regulator that classifies memecoins as securities, or that requires an identifiable issuer for a listed asset, would leave Shiba Inu unable to register or file, because it has never disclosed a legal entity. Shibarium and ShibaSwap add exposure the token alone does not carry, because a layer 2 that processes payments and a decentralized exchange that facilitates trading attract money transmission, virtual asset service provider, and market infrastructure rules in most major jurisdictions. The announced Shib Doggy DAO Foundation is the project's response to part of this, since its stated purpose is to legally encapsulate the DAO, and its legal name and formation status remain undisclosed, so its regulatory standing cannot be assessed.

(Source: Coinbase SHIB, HTX SHIB, Shibarium Foundational Blog, Crypto.news ShibaSwap)

(b) Entity-Level Regulatory Impact

Shiba Inu has disclosed no legal entity, which cuts both ways. No entity can be licensed, fined, or compelled to disclose, and equally no entity can hold a license, run a compliance program, respond to a subpoena, or defend the token before a regulator. Exposure therefore falls on individuals and on holders. The project's leadership operates under the pseudonyms Kaal Dhairya, who leads development, and Shytoshi Kusama, who stepped down as project lead in January 2025 and serves as lead ambassador. Both appeared for the project's only interview with faces concealed, and the core team controls validator keys and more than 100 mission-critical ecosystem contracts, which means a regulator or a court that identifies those individuals can pursue them personally for the operation of Shibarium and ShibaSwap. The September 2025 exploit sharpened that exposure, because the post-incident report placed ultimate responsibility for validator key management with operational leadership and disclosed that keys had been used on developer machines. Holders have no counterparty to sue and no jurisdiction in which the project is organized. The commitment to hand control to the community, and the announced foundation intended to legally encapsulate the DAO, are the project's two responses, and neither has been completed.

(Source: Arabian Business Interview, Yahoo Finance Kusama Steps Down, Shib Daily Kaal Dev Report, Arabian Business AB Majlis)

(c) Tokenholder Tax Treatment

Tax treatment of SHIB is unsettled and varies by jurisdiction. Holders who only buy and sell face an acquisition and disposal analysis, where each purchase establishes basis and each sale, swap, or spend is a disposal that may attract capital gains treatment. Holders who use the ecosystem face additional questions the token alone does not raise. Staking BONE to Shibarium validators and providing liquidity on ShibaSwap generate rewards that many jurisdictions treat as ordinary income at receipt and then again as a disposal on sale, and bridging SHIB between Ethereum and Shibarium can be treated as a disposal in jurisdictions that do not recognize a wrapped or bridged asset as the same property. Shibarium burns 70 percent of its transaction fees as SHIB, which reduces supply rather than distributing anything to holders, so it creates no income event. No Shiba Inu entity provides tax advice, issues tax forms, or reports on a holder's behalf, and each tokenholder is responsible for understanding and meeting their own tax obligations.

(Source: Shib Daily Ecosystem Guide, Crypto.news ShibaSwap, Doggy DAOs Documentation)

(d) Jurisdictional & User Access Restrictions

The SHIB token applies no jurisdictional restriction and no user-type restriction. The contract has no blacklist, no pause role, and no transfer hook, so no party can prevent any address anywhere from holding or transferring SHIB, and the permanently locked Uniswap liquidity means an onchain market exists regardless of any venue's decision. Restrictions exist at two other layers. Centralized venues apply their own onboarding, sanctions screening, and jurisdictional exclusion rules, so a user in an excluded jurisdiction can lose access without any change to the token. Shibarium now carries a blacklist feature added after the September 2025 exploit, under which flagged addresses cannot stake, unstake, or claim rewards, which means the project can restrict a user's participation in the layer 2 even though it cannot restrict SHIB itself. The project has not published the criteria for blacklisting, the party that decides, or any appeal process, and that discretion is the concrete access risk holders carry.

(Source: Etherscan SHIB Token, Bitget News Bridge Restored, Gemini Shiba Inu Guide, Coinbase SHIB)

(b) Protocol, Technology & Security Risks

(a) Bugs and Design Flaws

The SHIB token contract carries a narrow risk surface. It has no mint function, no owner role, no pause role, no blacklist, and no upgrade proxy, and its launch liquidity is locked in Uniswap with the keys destroyed, so supply cannot be inflated, transfers cannot be halted, and the base liquidity cannot be withdrawn. Because no authority exists over the contract, no defect in it could ever be patched and no party could freeze a compromised balance or recover stolen SHIB. The material design flaws sit in the ecosystem, and September 2025 demonstrated them rather than hypothesizing them. Shibarium's bridge accepted state signed by a two thirds validator majority with no independent check, so control of 10 of 12 signing keys was sufficient to withdraw its assets, and the project's own post-mortem acknowledged that 10 of 12 validators signing the malicious state was a decentralization failure, with only the K9 Finance and Unification validators declining to sign. Validator staking thresholds were reachable with flash-loaned BONE, which meant temporary capital could buy a governance-weight position. Withdrawal delays were a single checkpoint, which left no window in which honest validators could detect and contest fraudulent state. Key custody concentrated signing material in one cloud key management service with rare usage on developer machines, and the report named a developer machine compromise, a cloud key management compromise, exposure during an AWS to Google Cloud migration, and an npm supply-chain attack as the candidate intrusion vectors.

(Source: Shib Daily Kaal Dev Report, Cryptopolitan K9 Finance, The Block Bridge Restart, Gemini Shiba Inu Guide)

(b) Security Measures & Their Limitations

At the token level the measures are structural and permanent. SHIB has no mint function, no owner functions, and permanently locked launch liquidity, so supply integrity and base market depth are guaranteed and no privileged party can interfere with a transfer. At the ecosystem level the measures are the ones adopted after the September 2025 exploit. All validator signing keys were rotated. More than 100 mission-critical Shibarium, ShibaSwap, and Shiba Metaverse contracts were migrated to wallets governed by multi-party security procedures. A blacklist was added so flagged addresses cannot stake, unstake, or claim rewards. The restored bridge operates under a seven-day withdrawal challenge period. Independent security firms and law enforcement were engaged, the team published its post-mortem in October 2025, RPC infrastructure was consolidated with dRPC.org, new monitoring and playbooks were developed to detect checkpoint mismatches and key rotations, and the SOU repayment contracts launched in February 2026 were audited by Hexens before deployment. The limitations are specific. The measures are reactive rather than preventive, and every one of them was adopted after an attacker had already drained the bridge. The validator set remains small enough that a two thirds majority is 8 of 12 keys, and the project has not published the new custody arrangement, the signer identities, the signer count, or the threshold for the multisigs now holding the migrated contracts. The blacklist and the StakeManager rescue method are unilateral powers with no published criteria, no named decision-maker, and no appeal process, so the fix for centralized key risk introduced further centralized authority. The intrusion vector was not confirmed in the published post-mortem, and the project has not disclosed a third-party audit of the bridge itself, a bug bounty program covering the bridge, or a continuous monitoring arrangement with a named security firm.

(Source: Shib Daily Kaal Dev Report, The Block Bridge Restart, Cryptonews Bridge Reboot, Shib Magazine Bridge Update, U.Today SOU Launch)

(c) Token Economics, Unlocks & Incentive Risks

(a) Critical Economic Assumptions

Shiba Inu rests on three assumptions. The first is that speculative demand for the meme persists, because SHIB pays no dividend, distributes no fee revenue, and confers no claim against any entity, so its value depends on the next holder's willingness to buy. The second is that the burn mechanism can matter at scale, and the arithmetic works against it, because Shibarium converts 70 percent of its transaction fees into SHIB and burns them while circulating supply stands at roughly 589.24 trillion tokens, so daily burns typically measured in millions of tokens leave scarcity essentially unchanged. Cumulative burns of 410.84 trillion SHIB, or 41.08 percent of the original supply, have not created meaningful scarcity, and reaching a materially lower supply through burns alone would require Shibarium transaction volume orders of magnitude above anything the network has processed. The third is that ecosystem usage keeps growing, because the burn sink, the ShibaSwap fee base, and the governance system all depend on people transacting on Shibarium rather than simply holding SHIB on Ethereum. The September 2025 bridge exploit interrupted exactly that flow, and the exit of K9 Finance, which sunset all its Shibarium products in February 2026 over unresolved compensation, removed the network's principal liquid staking platform. A fourth assumption sits underneath the others, that exchange liquidity persists, and the permanently locked Uniswap pool guarantees an onchain market while the centralized venues that supply most of the depth do not.

(Source: Cryptonews Burn Mechanism, Crypt Eye Burn Tracker, Crypto Daily K9 Sunset, Crypto.news Shibarium Exploit)

(b) Governance Control over Monetary Policy & Rewards

No party can change SHIB's supply policy. The contract has no mint function and no owner functions, so no governance vote, no foundation, and no development team can inflate the supply, seize tokens, or alter the terms holders bought under, and the launch liquidity is locked beyond anyone's reach. That immutability is the strongest holder protection the project provides. Discretion exists over everything else. The Doggy DAO governs core protocol decisions, network governance, strategic initiatives, technical upgrades, rewards, utility, distribution mechanisms, and feature decisions, with BONE DAO holding the core protocol mandate, and proposal creators choose the voting strategy among staking-based voting, standard ERC-20 token voting, quadratic voting, and an identity-based one-vote-per-person model. That choice of strategy is itself a governance lever, because a proposer selecting token voting rather than quadratic or identity voting changes who can decide the outcome. The Shibarium fee split that routes 70 percent of transaction fees into SHIB burns is a parameter the ecosystem controls rather than a property of the token, so the burn rate can be changed. The powers that fall outside the DAO entirely are the ones the September 2025 exploit exposed and the remediation expanded, namely control of validator signing keys, the multisigs now holding more than 100 mission-critical contracts, the StakeManager blacklist that can bar an address from staking, unstaking, or claiming rewards, the StakeManager method used to seize 4.6 million BONE from the attacker, and the SOU repayment contracts that record and pay down what the ecosystem owes affected users. None of those required a DAO vote, and the project has not published who holds them, under what criteria they are exercised, or what recourse an affected holder has.

(Source: Doggy DAOs Documentation, Shib Daily Voting Strategies, U.Today SOU Launch, Shib Daily Kaal Dev Report, Gemini Shiba Inu Guide)