Cross-chain exploit funnels $5.25M into ETH

TLDR

A DeFi lending protocol on Hedera (HBAR) was exploited, with about $5.25 million stolen and bridged to Ethereum (ETH) as ETH and wrapped bitcoin.

1. Security firms report an attacker manipulated a Hedera DeFi protocols price oracle, borrowed assets, then bridged and converted roughly $5.25 million into ETH and WBTC on Ethereum.
2. The incident is tied to Bonzo Lend and Supras oracle verifier, and has sharply hit Hederas DeFi total value locked, highlighting ongoing structural risk in cross-chain and oracle-based systems.
3. The funds remain traceable on Ethereum for now, and the key things to watch are Hedera and Supras remediation steps, any fund recovery, and whether the attacker starts laundering through mixers again.

Confidence: high because multiple independent security firms and media reports agree on the core exploit pattern, even though Hedera has not fully detailed the incident yet.

Deep Dive

1. How The Exploit Worked

Blockchain security firm PeckShield says about $5.25 million was drained from the Hedera ecosystem and bridged to Ethereum, landing in a wallet seeded with 1 ETH from Tornado Cash and now holding roughly 2,360 ETH and 15.58 WBTC, worth around $5.25 million in total.PeckShield report

TradingView and Coinpedia note that the stolen tokens were first taken from a Hedera lending setup and then rapidly bridged using cross-chain infrastructure, before being swapped into ETH and WBTC and consolidated in a single Ethereum address.Coinpedia exploit summary

Separate technical reports link the root cause to Bonzo Lend and a flaw in Supras on-chain oracle verifier, where a manipulated SAUCE token price with a zeroed signature was accepted, letting the attacker deposit tiny collateral and borrow millions in USDC and wrapped HBAR before moving the value off Hedera.The Block incident detail

2. Impact On Hedera And DeFi

Price-wise, HBAR dropped around 3-5 percent toward the $0.066-$0.070 area, but reports emphasize this move sits inside an already bearish channel rather than a sudden collapse purely from the exploit.Coinpedia price context

The bigger damage is in DeFi: Coindesk notes Hederas total value locked fell nearly 40 percent in 24 hours to about $25.7 million, while Bonzo Lends TVL dropped roughly 77 percent after the attack, underscoring how confidence can evaporate when oracle infrastructure fails.Coindesk TVL impact

More broadly, cross-chain bridge and oracle exploits have already cost hundreds of millions of dollars in 2026, with Bitcoin.com highlighting over $328 million lost to bridge attacks in the first five months of the year, making this incident part of a wider pattern.Bridge-loss overview

3. What To Watch Next

Supra has acknowledged the verifier issue and pushed a fix on Hedera, while Bonzo paused lending and published a preliminary report, and at least one white-hat wallet that joined the exploit has contacted the team, pledging to return about $1 million.The Block incident detail

Security researchers are watching whether the attacker starts cycling the 2,360 ETH and 15.58 WBTC through mixers like Tornado Cash or other routes; until that happens, the wallet is flagged and traceable, which is helpful for law-enforcement or potential negotiations.PeckShield report

For users, the key signals will be: Hederas formal postmortem and any compensation plans, Supras broader oracle hardening on other chains, and whether Hederas TVL and HBAR price stabilize or keep sliding as confidence resets.

Conclusion

A flawed oracle verifier on a Hedera lending protocol enabled an attacker to conjure fake collateral, borrow real assets, and funnel roughly $5.25 million into ETH and WBTC on Ethereum.

The direct market hit to HBAR is modest so far, but the sharp drop in Hedera DeFi TVL and the broader backdrop of bridge and oracle exploits show that infrastructure risk, not just token volatility, is a central factor for crypto users to watch.