Hedera (HBAR) has reportedly suffered a suspected exploit, which has moved more than $5.8 million in assets to Ethereum. According to blockchain security researcher Specter, the attacker moved stolen assets off Hedera and converted them into Ethereum (ETH). The incident was first flagged on Saturday, with the attacker using LayerZero (ZRO) to bridge funds from Hedera to Ethereum, swapping stolen holdings from Wrapped Bitcoin (WBTC) into ETH. As reported by PeckShield, the bridged amount reached approximately $5.25 million, with the attacker's wallet holding roughly 2.36K ETH worth $4.25 million and 15.58 WBTC worth about $1 million. The wallet's estimated value has since increased to roughly $5.8 million, indicating that more assets had reached Ethereum after the initial transfers.
The tracked total rose quickly from $3.7 million to more than $4 million, then to more than $5.8 million. According to PeckShield, the attacker originally funded the wallet with 1 ETH routed through Tornado Cash, a mixing tool often used to obscure the source of funds. The wallet screenshots shared by both Specter and PeckShield showed a series of inbound transfers arriving within a short period before the assets were converted into ETH. The theft addresses identified by Specter are 0x9A4966152F6e10b33Cb7a37975e8619816d6a494 and 0xaf20D792A19fD42dCf697ceBa6100291D96dD93e. The wallet currently holds approximately 3,203 ETH, representing nearly 80% of the portfolio, alongside roughly 20% in WBTC.
HBAR fell more than 2% following the reports of the suspected exploit, trading around $0.069 as the incident unfolded. According to crypto.news, the price decline reflects market concerns about the security breach and its potential impact on the network. The cross-chain transfers have continued after the initial breach, with additional transactions appearing on-chain as the attacker moves assets through various wallets. Neither Specter nor PeckShield identified the party responsible for the suspected exploit, and no official estimate of the total losses has been released. The incident remains under investigation as blockchain security researchers continue monitoring the addresses and publishing updates as new transactions appear on-chain.
The Hedera exploit adds to a concerning trend of cryptocurrency thefts in 2026. According to DefiLlama, three hacks targeting crypto platforms occurred in July, resulting in combined losses exceeding $28 million. These incidents include a $6 million exploit of the DeFi protocol Summer.fi and a $20 million governance attack on the BONK DAO. As reported by SlowMist, security incidents climbed roughly 50% in the first half of 2026, even as total losses fell. The Hedera incident comes amid a series of security-related developments, including Blockaid's detection of an active exploit targeting Summer.fi and Ctrl Wallet's announcement of permanent shutdown after security exploits affecting Cardano wallets. Market participants are watching for an official statement from the Hedera team regarding the reported exploit and any measures taken to contain its impact.
