Finst

Hedera Exploit Tops $5 Million

The stolen funds were moved through LayerZero to Ethereum and partly converted into ETH and WBTC. PeckShield now estimates the losses at around $5.25 million.

By Zenz van der Wielen
• 2 min read
Hedera Exploit Tops $5 Million

Key Takeaways

  • Hedera is dealing with an exploit that has now pushed losses above $5 million.
  • According to Specter, the stolen funds were bridged through LayerZero to Ethereum and then swapped from Wrapped Bitcoin into ETH.
  • Hedera had not issued a public statement about the incident at the time of publication.

Hedera is facing an exploit that has now driven losses past $5 million (€4.4 million). Blockchain researcher Specter first flagged the incident on Saturday, and onchain trackers soon showed the stolen tokens being moved and swapped in stages.

How the Attack Unfolded

Specter said the stolen Hedera funds were bridged through LayerZero to Ethereum. From there, the attacker swapped the assets from Wrapped Bitcoin into ETH. The tracked amount first rose to $3.7 million (€3.2 million), then moved above $4 million (€3.5 million), before climbing past $5 million (€4.4 million).

Security firm PeckShield later estimated the bridged total at about $5.25 million (€4.6 million). Based on that figure, the attacker’s wallet held roughly 2.36K ETH, worth $4.25 million (€3.7 million), and 15.58 WBTC, worth around $1 million (€0.9 million). PeckShield also said the wallet was first funded with 1 ETH through Tornado Cash, a mixing tool often used to obscure the source of funds.

Why This Matters

The incident is part of a wider run of crypto attacks in July. According to DefiLlama, there have already been three hacks on crypto platforms this month, with total losses topping $28 million (€24.5 million). For European crypto readers, the main point is that these attacks are no longer limited to exchanges or DeFi protocols. Networks and the infrastructure around them are getting hit too.

That also fits a broader pattern of attackers moving through bridges and other infrastructure. With LayerZero, that debate came back into focus recently during a migration to an alternative cross-chain system.

Earlier Weak Spots

The latest exploit also revives memories of earlier security problems at Hedera. In March 2023, the network was hit by an exploit targeting DEX liquidity pools that used contract code derived from Uniswap v2 on the Hedera Token Service. Then in July 2024, Hedera’s marketing email was compromised, which triggered phishing attempts against users. Hedera also underwent a security assessment at the end of 2025 that found and fixed critical vulnerabilities, including a denial-of-service risk in the consensus node.

Hedera had not made a public statement about the current incident at the time of publication. BeInCrypto said it had contacted the company for comment.

Disclaimer: This content is for informational purposes only and does not constitute financial, investment, legal, or tax advice. The information provided may be incomplete, inaccurate, or outdated and should not be relied upon as such. Nothing on this website should be considered a recommendation to buy, sell, or hold any cryptocurrency. Investing in crypto-assets involves risk of loss.