More than $5.8 million bridged from Hedera to Ethereum after suspected security incident

According to CoinDesk, onchain security researchers are flagging a suspected security incident on Hedera after more than $5.8 million in assets were moved off the network and bridged to Ethereum. LayerZero was identified as the primary route for the outflows. Security researcher Specter said the attacker first shifted more than $3.7 million from Hedera before additional transfers followed. Onchain records shared by Specter indicate the assets crossed to Ethereum via LayerZero and were then swapped, including conversions from WBTC into ETH. PeckShield later published its own tracking update, estimating about $5.25 million from addresses linked to the suspected exploit has been transferred from Hedera mainnet to Ethereum. As additional transactions have appeared, the estimated value tied to the wallets has increased, with holdings concentrated in ETH. Public tracking data shows one associated address at one point held about 3,203 ETH—nearly 80% of its assets—with the remaining roughly 20% in WBTC. Earlier figures showed around 2,360 ETH and 15.58 WBTC, suggesting the bridged assets were actively converted into ETH rather than left in their original form. Researchers also shared two wallet addresses believed to be related to the incident to support continued monitoring. Key details observed so far: - Outflow size: more than $5.8 million - Bridge path: Hedera via LayerZero to Ethereum - Asset activity: some WBTC swapped into ETH HBAR fell more than 2% following the reports, briefly trading around $0.069. The official loss amount has not been disclosed. As of publication, neither Specter nor PeckShield has identified the attacker, and Hedera has not issued a statement confirming the scale of losses. PeckShield also noted the wallet initially received 1 ETH from Tornado Cash as startup funding, though the firm cautioned this onchain detail alone does not establish control or attribution. Market participants are awaiting Hedera's official update on the incident, its impact, and remediation steps.