Hedera Network Loses $5M to Attacker Who Laundered Funds via LayerZero

Published by James Harris on July 11, 2026July 11, 2026

The attacker who drained more than $5 million from the Hedera network on July 11 did not linger. Within hours of the initial alert from onchain investigator Specter, the funds had already crossed chains, with the attacker bridging proceeds to Ethereum via LayerZero and converting Wrapped Bitcoin into ETH. By the time blockchain security firm PeckShieldAlert corroborated the figures, the attacker’s wallet held approximately 2,360 ETH (around $4.25 million) and 15.58 WBTC (around $1 million). The starting capital: 1 ETH withdrawn from Tornado Cash.

The speed of the cross-chain exit is the operational detail that matters most here. Bridging through LayerZero and cycling through WBTC-to-ETH swaps is a well-worn laundering pattern, but the attacker’s ability to execute it while the theft was still being tallied in real time reflects a preparation level that goes beyond opportunism.

Why Hedera’s Architecture Made This Worse to Trace

Hedera does not run on a conventional blockchain. It uses a hashgraph consensus system, and its native token HBAR handles transaction fees and staking. That architecture has long drawn scrutiny for auditability, and this incident made the concern concrete. Onchain investigator ZachXBT wrote in response to Specter’s thread that “Hedera is basically a privacy chain because its block explorer is so bad,” a pointed observation from someone who traces hacked funds professionally. When a security incident unfolds in real time and experienced investigators are struggling to read the chain, the post-mortem becomes harder and the window for any network-level response narrows fast.

This is not the first time a non-EVM chain’s tooling gaps have compounded an exploit. During the Ronin bridge hack in March 2022, the $625 million theft went undetected for six days partly because cross-chain monitoring infrastructure was immature. Hedera’s situation is different in scale, but the underlying problem is the same: tracing tools have not kept pace with the network’s growth.

What the Council Model Has at Stake

Hedera’s governance structure is the part of this story that gets underreported. The network is run by a council of large enterprises, not a foundation or a DAO, and it has spent 2026 adding recognizable names. McLaren Racing joined in March. Accenture joined in April. Both cited the network’s governance model and enterprise focus. Hedera’s own X bio describes it as the choice of “the world’s leading Fortune 1,000 organizations” as a “trust layer of the digital economy.”

That positioning is now the liability. Enterprise clients do not evaluate security the way retail users do. They run procurement cycles, vendor risk assessments, and reputational audits. A $5 million exploit that unfolded publicly while investigators watched and the network stayed silent is exactly the kind of event that gets flagged in those reviews. Hedera had not issued any statement as of the time of reporting, which compounds the problem: the absence of communication is itself a data point for enterprise risk teams.

HBAR dropped roughly 4% in the 24 hours following the incident, settling around $0.068 with a market cap near $2.98 billion. The price move is relatively contained, but price is not the primary exposure here.

The Silence That Will Define the Response

The exploit’s reputational damage is still being written, and it will be written largely by whatever Hedera’s council publishes in its post-mortem. The council model that enterprise clients find attractive, centralized decision-making among known institutions, also means there is no ambiguity about who owns the response. If the post-mortem is detailed and addresses the block explorer criticism directly, the McLarens and Accentures of the council have something to point to. If it is vague or delayed, the gap between Hedera’s marketing language and its operational reality becomes harder to close.

The $5 million loss is recoverable in dollar terms. The audit trail problem ZachXBT flagged is structural, and that one takes longer.