Hedera exploit steals $5.25 million, assets moved Ethereum

A suspected exploit on the Hedera network has resulted in the theft of millions of dollars in digital assets, with funds being rapidly moved to the Ethereum blockchain. The incident, first flagged by on-chain investigators on July 11, 2026, has caused the price of Hedera's native token, HBAR, to decline and raised fresh concerns about security in the decentralized finance ecosystem.

Blockchain security firms PeckShield and Specter reported that an attacker exploited the Sauce Protocol, a DeFi lending platform on Hedera, through a price oracle manipulation. By depositing collateral and then manipulating asset prices, the attacker was able to borrow approximately 6.6 million USDC and 35 million HBAR. The stolen tokens were then swapped on SaucerSwap before being bridged off the Hedera network.

The attacker used LayerZero's cross-chain infrastructure to transfer the stolen assets from Hedera to Ethereum. Once on Ethereum, the funds, primarily in the form of Wrapped Bitcoin (WBTC), were swapped for Ether. Security analysts tracked the movement to specific wallet addresses. PeckShield later estimated the bridged amount at about 5.25 million, with the attacker's Ethereum wallet...