Cross-chain hack drains $5.25M into ETH

TLDR

A suspected exploit in Hederas DeFi ecosystem drained about $5.25 million, with the attacker bridging the stolen funds to Ethereum and converting them into ETH and wrapped bitcoin.

1. Security firms say 2,360 ETH and 15.58 WBTC now sit in the attackers Ethereum wallet, funded via Tornado Cash and bridged from Hedera using LayerZero.
2. Current analysis points to oracle manipulation in Hedera lending apps like Sauce Protocol and Bonzo Lend, not a direct Hedera Layer 1 failure.
3. HBAR and Hedera DeFi TVL have dipped, and the key things to watch are official postmortems, recovery efforts, and hardened oracle and bridge setups.

Deep Dive

1. Exploit Flow Into Ethereum

Blockchain security firm PeckShield reports that about $5.25 million was drained from the Hedera ecosystem and bridged to Ethereum, leaving 2,360 ETH and 15.58 WBTC in the attackers wallet seeded with 1 ETH from Tornado Cash. The funds were moved off Hedera and consolidated into Ethereum in a single address, in line with the classic pattern of mixer funding, exploit, then cross-chain exit to deeper liquidity markets like Ethereum.

Investigators note that the bridge path used LayerZero, with assets swapped from wrapped HBAR and other tokens into ETH and WBTC before or after bridging, making recovery harder and on-chain tracing more complex as flows fan out across Ethereum liquidity venues.

2. Oracle And Bridge Weak Points

Reporting from multiple outlets links the theft to DeFi protocols on Hedera rather than a direct failure in Hederas core consensus. One strand focuses on a Sauce Protocol lending exploit where a price oracle was manipulated to borrow roughly 6.6 million USDC and 35 million HBAR before funds were swapped and bridged to Ethereum via LayerZero, as described in a Sauce Protocol hack overview.

A parallel incident at Bonzo Lend shows how an oracle verifier bug at Supra allowed a worthless SAUCE deposit to be valued at many orders of magnitude higher, enabling about $9 million of overcollateralized borrowing, according to a Bonzo Lend oracle exploit report. Taken together, this reinforces that DeFi risk often sits at oracle and bridge layers, even when the base chain remains technically sound.

Cross-chain bridge and oracle exploits have already accounted for hundreds of millions in losses in 2026, with PeckShield highlighting cross-chain draining of $5.25 million from Hedera to Ethereum as part of a broader wave of such attacks.

3. Market Impact And What To Watch

HBAR has slipped a few percent around the news, while Hedera DeFi total value locked has dropped sharply, and Bonzo Lends TVL fell about 77 percent after the exploit, according to follow up analysis on Bonzos losses and TVL impact. The reaction is meaningful for Hederas nascent DeFi sector even if the dollar amount is small versus large chains.

For users and builders, the key signals to monitor are: 1) Hederas and Supras detailed technical postmortems, including how oracle verification and bridge controls are being hardened; 2) whether any funds are frozen, blacklisted, or voluntarily returned by white-hat participants; and 3) whether liquidity and user activity return to affected protocols or stay depressed, which would indicate lasting confidence damage.

Conclusion

This exploit shows how relatively small oracle and bridge failures can siphon millions into Ethereum, damaging trust in smaller DeFi ecosystems even when the base chain remains intact. If Hedera, Supra, and affected protocols respond with transparent fixes and stronger verification, confidence can gradually recover; if not, the incident may accelerate a broader shift of capital away from fragile cross-chain and oracle-dependent designs.