Losses exceed $5M in ongoing Hedera exploit

An attacker has drained more than $5 million from the Hedera network in an exploit that occurred on July 11, with the stolen funds already routed onto Ethereum. 

Onchain investigator Specter initially flagged on X what he stated to be an active hack of Hedera.

Specter put the early tally above $3.7 million and, within hours, reported that the figure had crossed $4 million and then finally wrote, “Total loss now 5M+.” 

The attacker, according to Specter, had bridged the proceeds to Ethereum using LayerZero and was converting Wrapped Bitcoin (WBTC) into Ether (ETH).

Blockchain security firm PeckShieldAlert then corroborated Specter’s account and added more detail, stating that $5.25 million had already been moved from Hedera Mainnet to Ethereum. 

The attacker’s starting funds were traced to 1 ETH withdrawn from Tornado Cash, and the wallet now holds around 2,360 ETH, which PeckShieldAlert put at $4.25 million, and 15.58 WBTC, which is valued at around $1 million.

A third account, from onchain observer @0xNox, also reported that over $4 million had been bridged to Ethereum through LayerZero, with the funds cycling through WBTC-to-ETH swaps.

Is tracing hacked funds easy on the Hedera blockchain?

Hedera does not use a conventional blockchain. Instead, it runs on a hashgraph consensus system built by the network’s founders, Dr. Leemon Baird and Mance Harmon, and its native token HBAR pays for transactions and secures the network through staking.

That architecture has drawn criticism over how difficult it is to audit. Responding to Specter’s thread, investigator ZachXBT wrote that “Hedera is basically a privacy chain because it’s block explorer is so bad,” a jab at how difficult the network is to trace during an incident like this one.

Could this exploit impact Hedera beyond the stolen funds?

Hedera is governed by a council of large enterprises, and it has spent 2026 recruiting brand-name members. McLaren Racing joined the Hedera Council in March, and Accenture joined in April, with both organizations citing the network’s governance model and enterprise focus as part of their reasons for joining.

On its X account bio, it has written, “The world’s leading Fortune 1,000 organizations choose Hedera as the trust layer of the digital economy.”

With such clientele and positioning, a theft that was discovered on-chain while it was happening still hit the platform, posing questions to its security narrative. 

Hedera has not made any statement regarding the exploit, but users and industry observers will be looking forward to it and the overall post-mortem.

HBAR currently trades around $0.068 as of the time of reporting, a decline of about 4% in the past 24 hours. It has a market capitalization of around $2.98 billion, having declined by over 3.9% in 24 hours, according to CoinMarketCap.

If you're reading this, you’re already ahead. Stay there with our newsletter.