Overview
- Blockchain analysts tracked progressive transfers on July 11 that moved roughly $5.8 million worth of assets from the Hedera mainnet into Ethereum using the LayerZero bridge.
- Security firms reported the attacker consolidated holdings on Ethereum into about 3,200 ETH and WBTC and executed swaps that converted much of the WBTC into ETH.
- On-chain traces show the attacker’s Ethereum wallet was initially funded with 1 ETH routed from the Tornado Cash mixer, a step that can obscure fund provenance.
- Hedera’s token HBAR fell more than 2% after the transfers were reported and researchers published the suspected attacker addresses for public monitoring.
- The incident is under active investigation with no official loss tally or attribution yet and it underscores growing concerns about security and fund recovery on cross-chain infrastructure.