Bridge exploit sends $5.25M onto ETH

TLDR

A Hedera (HBAR) ecosystem lending protocol was exploited, and around $5.25 million in stolen assets were bridged onto Ethereum (ETH).

1. A hacker manipulated a price oracle on Hederas Bonzo Lend/Sauce Protocol, borrowing millions in USDC and wrapped HBAR, then bridged and converted funds into ETH and WBTC.
2. Hederas core network appears intact so far, but DeFi TVL on Hedera dropped sharply and HBAR fell a few percent, highlighting ongoing oracle and bridge risks.
3. The key next steps are incident reports, potential recovery, and monitoring the attackers Ethereum wallet, alongside broader scrutiny of oracle and bridge design in DeFi.

Confidence: high because multiple security firms and news outlets report consistent details and on chain traces.

Deep Dive

1. How The Exploit Sent $5.25M To Ethereum

Blockchain security firm PeckShield reports that about $5.25 million was drained from Hedera and bridged to Ethereum. The attackers wallet, funded initially with 1 ETH from Tornado Cash, now holds roughly 2,360 ETH and 15.58 WBTC.

Investigations point to an exploit of Bonzo Lend, a Hedera based lending protocol that relied on a Supra oracle. The attacker deposited a small amount of SAUCE tokens as collateral, then manipulated the oracle so SAUCE was priced many orders of magnitude higher than reality, allowing them to borrow about 6.63 million USDC and over 34 million wrapped HBAR.

After draining the protocol, the attacker swapped stolen assets and used LayerZero to bridge them from Hedera to Ethereum, consolidating funds into the main Ethereum wallet, which is now under heavy on chain monitoring.

2. Impact On Hedera And DeFi Risk

Hederas native token HBAR reportedly dropped around 3 to 5 percent around the incident, but coverage stresses that Hederas core Layer 1 infrastructure has not been shown to be compromised; the issue sits with the oracle verifier and the affected DeFi protocol rather than the base network.

Bonzo Lends preliminary report and follow up analysis note that Hedera DeFi total value locked fell nearly 40 percent in 24 hours, as users pulled funds in response to the exploit. This fits a wider pattern where oracle failures and cross chain bridges are recurring weak points, with bridge exploits alone accounting for hundreds of millions of dollars in losses in 2026.

3. What To Watch Next

Several actors are now in focus: Bonzo Lend for its detailed post mortem and recovery plans, Supra for fixes to its oracle verifier, and Hedera for clarifying that the incident is isolated to middleware rather than a consensus failure. These statements will shape confidence in the ecosystem.

On chain sleuths and security firms are tracking the attackers Ethereum wallet for further movements, such as attempts to cycle funds through Tornado Cash again or split assets to additional addresses. Any coordinated law enforcement or white hat recovery action would likely start from these traces.

More broadly, expect renewed emphasis on stricter oracle validation, signature checks, and defense in depth around lending protocols and bridges, which could change how new DeFi apps on Hedera and other chains are audited and launched.

Conclusion

This exploit shows how a single flawed oracle on a DeFi lending protocol can unlock millions in borrowed assets, then funnel them across a bridge onto Ethereum. The technical vector is specific to Bonzo Lend and its oracle integration, but the pattern reinforces a broader lesson: the riskiest parts of crypto often sit in cross chain bridges and price feeds rather than the base networks themselves. Watching how Hedera, Supra, and Bonzo respond will help gauge whether this becomes a contained incident or a lasting hit to confidence in Hedera DeFi.