The Hedera ecosystem is under scrutiny after blockchain security firms flagged a suspected exploit that resulted in the loss of approximately $5.25 million in digital assets. The incident came to light after on-chain investigators observed stolen funds being bridged from the Hedera network to Ethereum, where they were consolidated into a single wallet.
Blockchain security firm PeckShieldAlert reported that the attacker had already moved the stolen assets to Ethereum. Although the incident initially fueled speculation that the Hedera network itself had been compromised, there is currently no official confirmation of a Layer-1 network breach. Instead, early investigations increasingly point toward a decentralized finance (DeFi) protocol operating within the Hedera ecosystem.
How the Attack Unfolded
The exploit first surfaced after security researchers detected a series of unusual cross-chain transactions originating from the Hedera ecosystem. The stolen assets were rapidly bridged to Ethereum, where they were converted into ETH and Wrapped Bitcoin (WBTC).
On-chain records show the attacker’s Ethereum wallet was funded with 1 ETH from Tornado Cash, likely to cover transaction fees while masking the source of the funds. Within hours, the wallet had accumulated over 2,284 ETH—worth more than $4.1 million at the time—and 15.58 WBTC valued at around $1 million.
The speed at which the funds were consolidated and transferred across chains reflects a common strategy used in crypto exploits, allowing attackers to quickly move assets away from the original blockchain before further laundering or liquidation.
Why Bonzo Finance Is Emerging as the Primary Suspect
While an official post-mortem is still awaited, early technical discussions within the Hedera community have centered on Bonzo Finance, a decentralized lending platform built on the network. Preliminary reports suggest the attacker may have manipulated a SAUCE token price oracle, artificially inflating collateral values before borrowing assets far beyond their legitimate value. The borrowed assets were then allegedly bridged to Ethereum and converted into ETH and WBTC.
If these findings are confirmed, the incident would represent an oracle manipulation attack, a category of DeFi exploits that has affected several lending platforms across different blockchain ecosystems over the past few years. However, these findings remain preliminary, and investigators have yet to publish a detailed technical analysis confirming the exact attack vector.
HBAR Price Slips 5% Following the Exploit
The suspected exploit has triggered negative action on the HBAR price, plunging nearly 5%. However, a closer observation suggests that the pullback is a part of an ongoing downtrend rather than a sudden breakdown caused by the exploit. Technically, the HBAR price continues to trade within a descending channel, reflecting a series of lower highs and lower lows since late May. The latest sell-off has pushed the price towards the channel’s lower support around $0.066, breaking which could push the token towards $0.060.
The MACD continues to trade below the zero line, indicating that bearish momentum remains intact despite signs of slowing selling pressure. Meanwhile, the Cumulative Volume Delta (CVD) remains negative, suggesting that aggressive sell orders continue to outweigh buying activity, even as HBAR approaches a key support region. Therefore, if the price triggered a rebound from the support, the token could rise above $0.07 and may further break the pattern to initiate a strong upswing to $0.08.
What’s Next for the Hedera Ecosystem & HBAR Price?
The suspected $5.25 million exploit has once again highlighted the security challenges facing the rapidly expanding DeFi ecosystem. While blockchain investigators have successfully traced the stolen funds to Ethereum, the exact attack vector remains under investigation, with early evidence pointing toward a protocol-level vulnerability rather than a compromise of Hedera’s Layer-1 network. For the HBAR price, the incident has added short-term selling pressure to an already bearish technical setup. However, an official confirmation may have a strong impact on the token, which could be seen in the next couple of days.