Peckshield reported that the Hedera network had been exploited, citing findings first surfaced by security analyst Specter. According to the alert, $5.25 million in stolen funds has already been moved from Hedera’s mainnet to Ethereum.

The attacker originally funded their wallet with 1 ETH drawn from Tornado Cash, a mixing service that obscures the trail of crypto transactions. The wallet now holds about 2,360 ETH worth $4.25 million and 15.58 wrapped bitcoin (WBTC), a tokenized version of bitcoin that trades on Ethereum, valued near $1 million.

Onchain data showing the funds compromised in the exploit being moved.

Hedera has not publicly confirmed the incident as of now, and the full scope of the theft beyond the bridged funds remains unclear. HBAR, the network’s native token, traded near $0.07 on July 11, down nearly 3% over the last 24 hours.

The muted price reaction seems indicative of how early the situation is, as neither the attack vector nor the affected applications have been identified publicly, and it is not yet known whether user accounts or protocol-level liquidity took the loss.

The pattern of seeding a wallet through a mixer, striking, then bridging the loot to Ethereum has become a standard playbook in recent years. In fact, cross-chain bridge exploits topped $328 million in the first five months of the year, with Bitcoin.com News reporting several such incidents over the past month. Most recently, an attacker flipped $11.5 million in stolen Verus assets to ether using an almost identical Tornado Cash setup.

It is also not Hedera’s first security incident given that in March 2023, attackers exploited the network’s smart contract service to drain liquidity pool tokens from decentralized exchanges including Saucerswap, Pangolin and Heliswap. That attack netted under $600,000, and the network shipped a fix within 41 hours of discovery, a response time the current episode will be measured against.

Over the coming day, all eyes will be on Hedera’s team and how it handles the situation, especially since they haven’t even confirmed the breach yet. Moreover, it will be interesting to see whether the attacker begins cycling the 2,360 ETH back through Tornado Cash. Until then, the $5.25 million sits in a wallet every onchain sleuth in the industry is now watching.

免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到support@aicoin.com，本平台相关工作人员将会进行核查。