Someone just walked off with $5.25 million from the Hedera network, and they didn’t exactly try to be subtle about it. Blockchain security firms PeckShield and Specter flagged the suspicious activity on July 11, tracking a trail of funds that moved from Hedera’s mainnet to Ethereum through a cross-chain bridge powered by LayerZero technology.
The timing is particularly awkward for Hedera. Just weeks after the network celebrated the launch of the first US spot HBAR ETF, it’s now dealing with a significant security incident.
How the exploit unfolded
The attacker funded an Ethereum wallet with 1 ETH routed through Tornado Cash, the privacy mixing service. From there, the attacker bridged assets from Hedera to Ethereum using LayerZero’s cross-chain infrastructure. Once the funds landed on Ethereum, the attacker swapped Wrapped Bitcoin for Ether, consolidating the stolen haul into more liquid assets.
At the time security researchers flagged the incident, the attacker’s Ethereum wallet held approximately 2,360 ETH, valued at about $4.25 million, along with 15.58 WBTC worth roughly $1 million. The wallet addresses involved have been identified as 0x9A4966152F6e10b33Cb7a37975e8619816d6a494 and 0xaf20D792A19fD42dCf697ceBa6100291D96dD93e.
