An attacker has stolen over $5 million from the Hedera network in a significant exploit on July 11, with the majority of the stolen assets already transferred to the Ethereum blockchain, according to multiple blockchain analysts.
Exploit details and fund movements
Onchain analyst Specter was among the first to report the ongoing attack, promptly flagging suspicious activity involving large sums moved from Hedera. Initial tallies from Specter estimated losses at $3.7 million, which soon increased to over $5 million as further transactions were tracked over several hours.
Specter indicated that the attacker bridged the funds to Ethereum via LayerZero, a protocol that enables interoperability between blockchain networks. The perpetrator then converted Wrapped Bitcoin (WBTC) into Ether (ETH) after the funds arrived on Ethereum.
Blockchain security firm PeckShieldAlert later confirmed the incident, revealing that $5.25 million had already been moved from Hedera to Ethereum. Investigators traced the initial capital to 1 ETH withdrawn from Tornado Cash, a crypto mixing protocol. At the time of reporting, the attacker’s Ethereum wallet held approximately 2,360 ETH, valued at roughly $4.25 million, alongside 15.58 WBTC, worth about $1 million.
Onchain observer @0xNox also noted more than $4 million was bridged to Ethereum through LayerZero, with funds being cycled through WBTC-to-ETH swaps.
Mini dictionary: LayerZero is an interoperability protocol designed to allow seamless transfers of assets and data across multiple blockchain networks, linking ecosystems such as Ethereum and non-EVM chains.
| Asset | Amount | Value (approximate) |
|---|---|---|
| ETH | 2,360 | $4.25 million |
| WBTC | 15.58 | $1 million |
PeckShieldAlert confirmed that $5.25 million was transferred from Hedera Mainnet to Ethereum, with the attacker’s wallet containing both ETH and WBTC after the swap process.
Transparency concerns on Hedera
Hedera, founded by Dr. Leemon Baird and Mance Harmon, operates on a unique hashgraph consensus system rather than a traditional blockchain. Its native token, HBAR, is used for transaction fees and securing the network through staking. However, auditing incidents on the platform has proven challenging.
Blockchain investigator ZachXBT commented on social media that Hedera’s lack of a reliable block explorer effectively turns it into a “privacy chain,” since tracking and tracing suspicious transactions is particularly difficult for third parties.
ZachXBT remarked that limited block explorer functionality on Hedera poses challenges for transparency, especially during active security incidents.
Mini dictionary: Hashgraph is a consensus algorithm distinct from traditional blockchains, enabling faster and fairer transaction ordering and increased throughput, but often making third-party transaction tracing more complex.
Potential impact and market reaction
Hedera is governed by a council consisting of major global enterprises. In 2026, the platform attracted members such as McLaren Racing and Accenture, both citing the network’s enterprise-focused governance and infrastructure as key benefits. Hedera markets itself as the chosen trust layer for large organizations worldwide.
Despite these endorsements, the exploit has raised questions about network security and transparency. As of now, Hedera has not released any official statement regarding the exploit, but users and industry participants are awaiting further clarification and a detailed investigation.
HBAR, Hedera’s native cryptocurrency, is currently priced near $0.068, marking a 4% drop in the past 24 hours. The token’s market capitalization has fallen to around $2.98 billion, down just under 4% over the same period, according to CoinMarketCap data.
