Peckshield flagged a suspected exploit on the Hedera network on July 11, reporting that $5.25 million in funds had been bridged from Hedera's mainnet to Ethereum. The attacker's wallet, originally seeded with 1 ETH from Tornado Cash, now holds approximately 2,360 ETH worth $4.25 million and 15.58 wrapped bitcoin (WBTC) valued near $1 million. Cross-chain bridge exploits have topped $328 million in the first five months of the year, making this incident part of a broader security trend affecting blockchain networks.
Attacker Wallet Holds 2,360 ETH and 15.58 WBTC
Peckshield reported the Hedera network had been exploited, citing findings first surfaced by security analyst Specter. The attacker originally funded their wallet with 1 ETH drawn from Tornado Cash, a mixing service that obscures the trail of crypto transactions. The wallet now holds about 2,360 ETH worth $4.25 million and 15.58 wrapped bitcoin (WBTC), a tokenized version of bitcoin that trades on Ethereum, valued near $1 million.
![Onchain data showing the funds compromised in the exploit being moved.]()
Onchain data showing the funds compromised in the exploit being moved.
Hedera Has Not Confirmed Breach as HBAR Trades Near $0.070
Hedera has not publicly confirmed the incident as of now, and the full scope of the theft beyond the bridged funds remains unclear. HBAR, the network's native token, traded near $0.07 on July 11, down nearly 3% over the last 24 hours. The muted price reaction seems indicative of how early the situation is, as neither the attack vector nor the affected applications have been identified publicly, and it is not yet known whether user accounts or protocol-level liquidity took the loss.
Cross-Chain Bridge Exploits Topped $328 Million in First Five Months
The pattern of seeding a wallet through a mixer, striking, then bridging the loot to Ethereum has become a standard playbook in recent years. Cross-chain bridge exploits topped $328 million in the first five months of the year. Most recently, an attacker flipped $11.5 million in stolen Verus assets to ether using an almost identical Tornado Cash setup.
This is not Hedera's first security incident. In March 2023, attackers exploited the network's smart contract service to drain liquidity pool tokens from decentralized exchanges including Saucerswap, Pangolin and Heliswap. That attack netted under $600,000, and the network shipped a fix within 41 hours of discovery.
FAQ
What happened to the Hedera network on July 11?
Peckshield flagged a suspected exploit on the Hedera network on July 11, reporting that $5.25 million in funds had been bridged from Hedera's mainnet to Ethereum. The attacker's wallet, originally seeded with 1 ETH from Tornado Cash, now holds approximately 2,360 ETH worth $4.25 million and 15.58 wrapped bitcoin (WBTC) valued near $1 million.
How did the attacker fund their wallet in the Hedera exploit?
The attacker originally funded their wallet with 1 ETH drawn from Tornado Cash, a mixing service that obscures the trail of crypto transactions. The wallet now holds about 2,360 ETH worth $4.25 million and 15.58 wrapped bitcoin (WBTC) valued near $1 million.
Has Hedera confirmed the breach?
Hedera has not publicly confirmed the incident as of now, and the full scope of the theft beyond the bridged funds remains unclear. HBAR, the network's native token, traded near $0.07 on July 11, down nearly 3% over the last 24 hours.
