Hedera ecosystem hit by a suspected $5.25 million vulnerability: Will security breaches drive down H

The Hedera ecosystem is suspected to be attacked, with approximately US$5.25 million in digital assets stolen

The blockchain security company discovered a suspected attack that resulted in the loss of approximately US$5.25 million in digital assets in the Hedera ecosystem. This matter has attracted widespread attention. On-chain investigators observed stolen funds being transferred across the chain from the Hedera network to Ethereum and concentrated in a wallet, and the incident was subsequently exposed.

Blockchain security company PeckShieldAlert reported that attackers had transferred stolen assets to Ethereum. Although the incident initially sparked speculation that the Hedera network itself had been compromised, there has been no official confirmation that the Layer-1 network had been compromised. Instead, early investigations increasingly point to a decentralized finance (DeFi) protocol operating within the Hedera ecosystem.

How did the attack happen

The attack first surfaced after security researchers detected a series of unusual cross-chain transactions in the Hedera ecosystem. Stolen assets were quickly bridged to Ethereum, where they were exchanged for ETH and packaged Bitcoin (WBTC).

On-chain records show that the attacker's Ethereum wallet obtained 1 ETH through Tornado Cash, which is likely used to pay transaction fees while concealing the source of the funds. Within hours, the wallet had accumulated more than 2284 ETH (worth more than $4.1 million at the time) and 15.58 WBTC (worth approximately $1 million).

The rapid concentration and transfer of funds across chains reflects strategies commonly used in cryptocurrency attacks, allowing attackers to quickly transfer assets out of the original blockchain before further laundering or monetization.

Why Bonzo Finance became the main suspect

Although the official post-mortem analysis report has not yet been released, early technical discussions within the Hedera community have focused on Bonzo Finance, a decentralized lending platform built on the network. Preliminary reports suggest that the attacker may have manipulated the price oracle of SAUCE tokens, artificially inflated the value of the collateral, and then borrowed assets far in excess of their legitimate value. These borrowed assets were subsequently bridged to Ethereum and exchanged for ETH and WBTC.

If these findings are confirmed, the incident will fall under a oracle manipulation attack, a type of DeFi attack that has affected lending platforms in multiple different blockchain ecosystems over the past few years. However, these findings are still in the preliminary stage, and investigators have not yet released detailed technical analysis to confirm the exact attack vector.

HBAR prices fall 5% after attack

The suspected attack triggered a negative reaction from HBAR prices, which fell nearly 5%. However, closer observation suggests that the correction was part of a continuing downward trend rather than a sudden collapse caused by an attack. From a technical perspective, HBAR prices are still trading in a downward channel, showing a series of lower highs and lower lows since late May. The recent sell-off has pushed the price near the support level at around $0.066 on the lower edge of the channel, and if this support falls below, the token may fall further to $0.060.

The MACD indicator continues to move below the zero axis, indicating that although selling pressure has eased, bearish momentum remains. At the same time, the cumulative volume margin (CVD) remains negative, indicating that active sell orders continue to exceed buying activity even as HBAR approaches key support areas. Therefore, if the price rebounds from support, the token may rise above US$0.07 and may break further out of this pattern, initiating a strong rise to US$0.08.

How the Hedera ecosystem and HBAR prices will evolve next

This suspected $5.25 million attack once again highlights the security challenges facing the rapidly expanding DeFi ecosystem. Although blockchain investigators have successfully traced the flow of stolen funds to Ethereum, the exact attack vector is still under investigation, and early evidence points to a protocol level vulnerability rather than a breach of the Hedera Layer-1 network. For HBAR prices, the event added short-term selling pressure to an already bearish technical pattern. However, official confirmation may have a strong impact on the token, and the outcome may be seen in the next few days.