Suspected Hedera Network Exploit Sends Over $5.8M to Ethereum

Highlights:

• Hedera Network exploit sent more than $5.8 million in tracked assets to Ethereum.
• Researchers linked the suspected attack to Sauce Protocol oracle manipulation.
• HBAR declined nearly 3% as reports of the suspected exploit circulated.

A suspected Hedera Network exploit sent more than $5.8 million in assets to Ethereum, according to on-chain researchers. Security firms Specter and PeckShield both tracked funds leaving the network through LayerZero before reaching Ethereum wallets.

The attacker then swapped Wrapped Bitcoin for Ether, consolidating much of the stolen value into liquid assets. Early estimates placed the loss near $5.25 million, though later tracking pushed the total above $5.8 million.

Hedera Network Exploit Draws Security Scrutiny

Researchers first noticed several large transfers moving from Hedera toward Ethereum within a short period. Specter reported that the attacker initially bridged more than $3.7 million before sending additional assets across chains. PeckShield later estimated that about $5.25 million had already reached Ethereum from the Hedera mainnet.

At that point, the wallet reportedly held around 2,360 ETH and 15.58 WBTC. The ETH carried an estimated value of $4.25 million, while the WBTC was worth about $1 million. The attacker reportedly funded the main wallet with 1 ETH from Tornado Cash before the exploit. That transaction showed the wallet’s funding route, although it did not reveal the person controlling it.

#PeckShieldAlert Specter has reported that @hedera Network appeared to be exploited, with $5.25M in stolen funds already bridged from #Hedera Mainnet to Ethereum.

The hacker originally funded 1 ETH from #TornadoCash and now holds 2.36K ETH ($4.25M) & 15.58 WBTC ($1M) in the… pic.twitter.com/bPcKx0FXpO

— PeckShieldAlert (@PeckShieldAlert) July 11, 2026

The researchers also linked the activity to two Ethereum addresses. The first address was 0x9A4966152F6e10b33Cb7a37975e8619816d6a494. The second was 0xaf20D792A19fD42dCf697ceBa6100291D96dD93e. 

Sauce Protocol Oracle Manipulation Drives Losses

Reports linked the incident to Sauce Protocol rather than Hedera’s base network. According to those findings, the attacker manipulated a price oracle after depositing collateral into the lending platform.

The altered price allowed the attacker to borrow nearly 6.6 million USDC and about 35 million HBAR. Afterward, the attacker swapped the stolen tokens through SaucerSwap before moving funds across chains. LayerZero then carried the assets from Hedera to Ethereum, placing them beyond the original network.

🚨HEDERA EXPLOIT: SAUCE PROTOCOL HIT BY ORACLE MANIPULATION, OVER $5M STOLEN!

Attacker deposited collateral, manipulated oracle prices, borrowed ~6.6M $USDC + 35M $HBAR, swapped on SaucerSwap, and bridged funds to Ethereum.

Stolen assets, now ~2.36K $ETH + 15.58 $WBTC, tracked… pic.twitter.com/qgw7fpNStK

— Crypto Banter (@crypto_banter) July 11, 2026

On-chain records showed repeated WBTC transfers between wallets after the funds reached Ethereum. Those movements suggested an effort to separate the assets and complicate transaction tracking. The suspected exploit therefore affected a DeFi application within the Hedera ecosystem.

Ethereum Transfers Continue as Investigation Develops

The attacker converted part of the bridged WBTC into ETH after reaching Ethereum. That strategy concentrated the stolen value in a widely traded asset with deeper liquidity. Meanwhile, wallet screenshots showed several inbound transfers arriving before the conversions took place. Researchers continued publishing updates while the total loss estimate moved higher. For instance, CryptoBull360 noted that the wallet’s estimated value had increased to $5.8 million.

The #Hedera network hack amount keeps growing.

$4.48M to $5.8M$HBAR pic.twitter.com/2sghPPGGbT

— CryptoBull_360 (@CryptoBull_360) July 11, 2026

At the same time, the Hedera Network team had not issued an official statement. No confirmed recovery plan or reimbursement process has emerged. The investigation also has not established which vulnerability gave the attacker initial access.

The incident adds to several crypto security breaches reported during recent weeks. Crypto2Community reported that 40 major breaches during June, producing estimated losses of $75.87 million. That figure marked a 7.13% decline from the $81.7 million recorded during May.

Meanwhile, Hedera’s native token HBAR has dropped nearly 2% to $0.06970 after reports of the exploit spread across the market. Its market cap and trading volume stand at $3 billion and $92 million, respectively.