Hedera Network is facing scrutiny after on-chain investigator Specter said on July 11 that the network may have been exploited. According to the alert, more than $3.7 million was moved from Hedera to Ethereum through LayerZero, and the stolen funds are now being converted from WBTC into ETH. At the time of publication, Hedera had not confirmed the incident, and the exact scale of losses and the point of failure remained unclear.
The swaps from WBTC into ETH stand out. WBTC is a centralized asset custodied by BitGo, which has the ability to freeze tokens at specific addresses. ETH does not carry that same issuer-level control. In cases like this, moving quickly from WBTC into ETH is commonly seen as an attempt to avoid possible freezes and make recovery harder.
A newly opened Bitcoin liquidity route is now under pressure
WBTC was only recently introduced to Hedera through BitGo, BiT Global, and LayerZero. That integration was meant to expand Hedera’s Bitcoin DeFi, or BTCfi, footprint, and had brought in more than $100 million in Bitcoin liquidity to the network. The suspected exploit appears to have hit right along that newly opened route.
Even so, the available facts do not show where the vulnerability originated. The attacker used LayerZero to move funds out, but that alone does not prove LayerZero itself was the compromised component. At this stage, the exploit path is still unresolved.
Security questions return for both LayerZero and Hedera
LayerZero has already been part of major cross-chain security discussions this year. The source material notes that in April, KelpDAO’s rsETH bridge lost around $292 million after its verification process was breached, and LayerZero later said it had “made a mistake” in its response. For the Hedera case, though, there is still no conclusion on whether LayerZero was directly exploited or merely used as an exit route for the funds.
Hedera has its own history of security incidents. In March 2023, the network was attacked through a vulnerability in a precompiled contract tied to its smart contract service. The attacker moved tokens out through the HashPort bridge. Actual losses were reported at about $600,000, while damage to the broader ecosystem was at one point estimated at $12 million.
The story is still developing. Full attacker addresses, the final destination of the funds, and formal responses from Hedera and LayerZero have yet to be disclosed.