The crypto community experienced another wave of panic: the alleged hack of LayerZero protocol wallets worth $2.4 million turned out to be a routine internal operation. This incident once again demonstrates how quickly misinformation spreads in our sphere and how easily standard fund movements can be misinterpreted.
The situation began to unfold when security service PeckShield flagged suspicious activity. According to their initial analysis, the Executor wallets of the LayerZero protocol appeared compromised. A mass withdrawal of funds was observed from several networks simultaneously, including BNB Chain, Base, Arbitrum, Avalanche, Optimism, Mantle, Plasma, and Ethereum. The attacker allegedly consolidated the stolen assets on the Ethereum network, swapping most of them for 956 ETH (approximately $1.79 million) and $322,000 in USDC.
Echoes of panic online
PeckShield's signal was immediately picked up by other observers. WuBlockchain, citing Specter, estimated losses at roughly $2.1 million, noting that funds were moving through Stargate and Relay services. Analyst Zakaria Sharif also suggested the Executor wallet had been compromised, citing a similar amount of damage. It seemed we were dealing with yet another large-scale attack on an infrastructure protocol.
Official denial and post-mortem analysis
However, the panic did not last long. The LayerZero developers themselves were the first to refute the alarm. They clearly stated that the funds were withdrawn from internal wallets as part of standard asset management operations, emphasizing that "nothing is at risk." Project co-founder Bryan Pellegrino publicly expressed surprise that this story even emerged, explaining that it was merely "a routine consolidation of assets."
This position was quickly supported by independent analysts. Expert Crypto Patel directly called the reports of a $2.4 million hack a false alarm, describing the transfers as part of a routine internal rebalancing. Service Verdict noted that the alleged hack caused the market to panic for about four hours: "956 ETH moved, headlines appeared, and some protocols paused operations."
Expert opinion: This incident is a vivid example of how, in the cryptocurrency ecosystem, a routine event can trigger a chain reaction due to a lack of proper verification. The market reacts too sharply to loud but unverified headlines. The main lesson here is that before labeling a fund movement as a hack, time must be spent on thorough data verification and waiting for official comments from the project team. Hasty conclusions harm not only the specific protocol but also trust in the entire industry.