Hedera HBAR Exploit Tally Climbs to $5.25 Million in Bridged Funds

HBAR News

Hedera (HBAR), the enterprise-focused distributed ledger, was hit by an exploit that has driven tracked losses past $5 million, according to on-chain data first surfaced over the weekend. The incident came to light on Saturday when blockchain trackers flagged suspicious outflows from wallets tied to the network. The attacker moved stolen assets off Hedera and began converting them, with the monitored tally rising steadily from an initial $3.7 million estimate. Hedera has not issued a public statement on the breach, leaving the exact attack vector unconfirmed. For an altcoin of Hedera’s standing, a theft of this scale raises immediate questions about smart-contract and access-control safeguards.

The attacker bridged the stolen funds from Hedera to Ethereum (ETH) using a cross-chain messaging protocol, on-chain trackers show. Once moved, the holdings were swapped out of Wrapped Bitcoin (WBTC) and consolidated into Ether. The routing mirrors a familiar laundering pattern, where illicit proceeds are pushed across chains to complicate recovery and obscure their origin. Cross-chain bridges, the infrastructure that lets assets travel between otherwise isolated networks, have become a recurring conduit in large thefts. The rapid atomic swap into a single liquid asset suggests the perpetrator prioritized speed over stealth, repositioning value before exchanges and analysts could flag the wallets.

A blockchain security firm later put the bridged amount at roughly $5.25 million, refining earlier estimates. Its analysis pegged the attacker’s wallet holdings at approximately 2.36K ETH, worth about $4.25 million, alongside 15.58 WBTC valued near $1 million. That breakdown places the bulk of the stolen value in Ether, consistent with the observed conversion trail. The steady upward revisions — from $3.7 million to above $4 million and then past $5 million — reflect how tracked totals often grow as researchers map additional addresses linked to a single actor. The figure remains provisional, and the final loss could shift as more wallets are attributed to the exploit.

On-chain records indicate the attacker originally funded the operation with 1 ETH routed through a well-known mixing service, a tool designed to sever the on-chain link between a wallet and its source of capital. The use of such a mixer at the outset points to premeditation and an effort to preserve anonymity from the first transaction. Two theft-linked addresses have been identified and are being monitored for further movement. Mixers remain a persistent obstacle for investigators, breaking the transparent trail that public ledgers otherwise provide. Their appearance in the funding stage, rather than only the cash-out, underscores how deliberately the attacker structured the scheme.

The breach adds to a difficult stretch for crypto security. On-chain and industry tallies count three separate hacks targeting platforms in July alone, with combined losses exceeding $28 million. Those include a $6 million exploit of a DeFi lending protocol built on an automated market maker model, and a $20 million governance attack that drained a DAO treasury. The clustering of incidents within a single month has renewed scrutiny of contract-level risk across the sector. An exploit of this size carries reputational weight beyond the dollar figure, testing confidence in Hedera’s security assurances at a moment when the broader market is already trading in bear market conditions.

The pace fits a broader pattern documented in recent security research: incident frequency climbed roughly 50% in the first half of 2026, even as aggregate dollar losses declined over the same period. The divergence suggests attackers are striking more often but extracting less per event, a shift that puts a premium on rapid detection and response. Hedera had not issued a public statement on the current incident as of the latest checks, and the network’s team has not confirmed the root cause. Until an official post-mortem emerges, the scope, method and any prospect of fund recovery remain open questions for holders watching the situation develop.

COINOTAG’s proprietary 42-indicator composite S/R scoring engine rates the $0.0685 support at a maximum 100/100, driven by a tight confluence of the ATR Lower band, Keltner Lower and Bollinger Band Lower — the last defined line before deeper downside. Overhead, the engine scores the $0.0757 resistance at 85/100, anchored by the Ichimoku Kijun and a prior swing high. With spot near $0.0688, RSI at 36.75 and a confirmed downtrend, momentum sits closer to oversold than overbought. Perp funding at -0.0068% against $20.66 million in open interest signals defensive positioning, while a Fear & Greed reading of 26 marks outright fear. A daily close below $0.0685 invalidates the near-term floor and opens the $0.0572 zone; reclaiming $0.0757 is the bullish trigger.