{"investigation":{"slug":"hedera","entity_name":"Hedera","trust_score":55,"severity_base":null,"score_modifier":0,"confidence":0.78,"status":"published","content_type":"investigation","summary":"Hedera is a public distributed ledger technology platform using a patented hashgraph consensus mechanism, launched to mainnet in September 2019. In March 2023, the network suffered a protocol-level exploit in its Smart Contract Service that drained approximately $600,000 in liquidity pool tokens from three decentralized exchanges, requiring a full mainnet proxy shutdown for 41 hours. The platform operates under a council governance model comprising up to 39 global enterprises, which provides institutional stability but draws criticism for centralization relative to permissionless blockchains.","sections":[{"content":"Hedera is a public distributed ledger technology (DLT) platform that uses the hashgraph consensus algorithm rather than traditional blockchain architecture. The hashgraph mechanism employs a gossip-about-gossip protocol combined with virtual voting, implemented over a Directed Acyclic Graph (DAG) structure that allows multiple transactions to be processed in parallel. Hedera claims throughput exceeding 10,000 transactions per second (TPS) with finality in 3 to 5 seconds and average transaction fees of approximately $0.0001 USD. The platform's native token is HBAR, with a fixed maximum supply of 50 billion tokens. HBAR is used to pay for network services, transaction fees, and as a mechanism to secure the network via staking. The mainnet launched in open access in September 2019. Hedera's services include a Smart Contract Service (EVM-compatible), a Token Service (HTS), a File Service, and a Consensus Service designed for enterprise timestamping and ordering of events.","heading":"Protocol Overview","sources":[{"url":"https://en.wikipedia.org/wiki/Hedera_(distributed_ledger)","name":"en.wikipedia.org","type":"other","credibility":3},{"url":"https://hedera.com/blog/analysis-remediation-of-the-precompile-attack-on-the-hedera-network/","name":"hedera.com","type":"other","credibility":3},{"url":"https://www.bitget.com/academy/hedera-hbar-blockchain","name":"bitget.com","type":"other","credibility":3}],"severity":"medium"},{"content":"On March 9, 2023, an attacker exploited a bug in the Smart Contract Service code of the Hedera mainnet to transfer Hedera Token Service (HTS) tokens held by decentralized exchange (DEX) liquidity pools to the attacker's own account. The vulnerability arose from the process of converting EVM-compatible smart contract code onto the Hedera Token Service: through a delegatecall() instruction invoking a precompiled contract, execution left the EVM and entered the core layer-one logic where balance state was shared, allowing one contract to impersonate another and illicitly authorize token withdrawals. Three DEXs were targeted — Pangolin, SaucerSwap, and HeliSwap — all of which used Uniswap v2-derived contract code ported to Hedera. Tokens stolen included approximately 1,001 DAI, 66,997 USDT, 287,998 USDC, and 3,630,000 WHBAR, totaling approximately $600,000 USD at the time of the attack. Suspicious activity was detected when the attacker attempted to move stolen tokens across the Hashport bridge, prompting bridge operators to pause the bridge. The Hedera DevOps team disabled mainnet proxy access at 20:18 UTC on March 9, preventing both further theft and user access. A fix was developed and tested within 13 hours of initial notification. The mainnet was upgraded and fully restored at 02:04 UTC on March 11, 41 hours after the initial discovery. The permanent remediation prevents smart contracts from using delegateCall to invoke precompiled HTS contracts. Hedera subsequently conducted a full security audit of the Smart Contract Service and found no additional vulnerabilities. The exploit is notable as a protocol logic bug rather than a user-side failure or economic attack.","heading":"March 2023 Smart Contract Exploit","sources":[{"url":"https://hedera.com/blog/analysis-remediation-of-the-precompile-attack-on-the-hedera-network/","name":"hedera.com","type":"other","credibility":3},{"url":"https://www.theblock.co/post/218714/hedera-confirms-hackers-stole-tokens-from-dexs-exploiting-a-bug-in-smart-contract-service","name":"theblock.co","type":"other","credibility":3},{"url":"https://medium.com/pangolin-exchange/postmortem-the-march-9th-hack-on-hedera-6b5f9963c4fa","name":"medium.com","type":"other","credibility":3},{"url":"https://www.coindesk.com/business/2023/03/09/hedera-turns-off-services-after-network-irregularities","name":"coindesk.com","type":"other","credibility":3}],"severity":"medium"},{"content":"In June 2025, the FBI's Internet Crime Complaint Center (IC3) issued a formal public service announcement warning that cybercriminals were actively defrauding Hedera Hashgraph non-custodial wallet users through NFT airdrops disguised as free rewards. The attack method involves sending unsolicited NFTs or tokens to users' wallets containing memo fields with embedded URLs. When users click these links to claim alleged rewards, they are directed to phishing sites requesting wallet seed phrases or passwords, after which the attacker drains the victim's wallet. Additional vectors include fake airdrop advertisements on social media and phishing emails. Hedera has publicly stated the network does not conduct airdrops. A separate investigation by HashPack — a Hedera wallet provider — documented a specific prolific scammer active since at least November 2022, operating under account identifier '2015717', who conducted mass microtransaction campaigns to tens of thousands of accounts directing victims to cloned versions of the Hedera website and fake wallet interfaces. These scam operations are distinct from the March 2023 protocol exploit and represent ongoing social engineering threats to the Hedera user base.","heading":"FBI Warning: NFT Airdrop Phishing Scams Targeting Hedera Users","sources":[{"url":"https://www.ic3.gov/PSA/2025/PSA250603","name":"ic3.gov","type":"other","credibility":3},{"url":"https://www.fbi.gov/investigate/cyber/alerts/2025/cybercriminals-defraud-hedera-hashgraph-network-non-custodial-wallet-users-through-nonfungible-token-airdrops-disguised-as-free-rewards","name":"fbi.gov","type":"other","credibility":3},{"url":"https://www.bleepingcomputer.com/news/security/fbi-warns-of-nft-airdrop-scams-targeting-hedera-hashgraph-wallets/","name":"bleepingcomputer.com","type":"other","credibility":3},{"url":"https://www.hashpack.app/community-blog/hederas-march-9-exploiter-a-prolific-scammer-within-the-hedera-ecosystem","name":"hashpack.app","type":"other","credibility":3}],"severity":"medium"},{"content":"Hedera operates under a Governing Council model comprising up to 39 global organizations, including Google, IBM, Dell Technologies, Boeing, Deutsche Telekom, LG Electronics, Standard Bank, Chainlink Labs, and Ubisoft as of 2025. Council members are responsible for operating consensus nodes, managing the HBAR treasury, and setting strategic direction. Each member holds equal voting rights. Terms are limited to two consecutive three-year periods. In November 2024, the Council approved governance reforms reducing the board size from seven to five members, with two seats designated for members unaffiliated with council organizations. Critics have noted that this model concentrates network operation and governance in a small set of identifiable corporate actors, which contrasts with the permissionless node participation model of networks such as Ethereum or Bitcoin. Academic research published on arXiv found that the Hedera network exhibits a high concentration of wealth and a shrinking intermediary core that handles a disproportionate share of transactions. An additional concern raised by researchers is that the initial council member selection process lacked transparency and may present conflicts of interest among corporate participants. Hedera and its supporters argue the council model provides the regulatory certainty and operational stability required for enterprise adoption, and that equal voting rights among members mitigate single-point-of-control risks.","heading":"Governance Structure and Centralization Concerns","sources":[{"url":"https://hederacouncil.org/","name":"hederacouncil.org","type":"other","credibility":3},{"url":"https://hedera.com/blog/a-new-era-for-hedera/","name":"hedera.com","type":"other","credibility":3},{"url":"https://arxiv.org/pdf/2311.06865","name":"arxiv.org","type":"other","credibility":3},{"url":"https://allincrypto.com/understanding-hederas-governing-council-and-its-impact-on-decentralization/","name":"allincrypto.com","type":"other","credibility":3}],"severity":"medium"},{"content":"HBAR has a fixed maximum supply of 50 billion tokens with a scheduled release extending through the mid-2020s. Token distribution categories include founding team and advisors, ecosystem development, purchase agreements with early investors, and treasury reserves. Critics have raised concerns about the pace and opacity of token releases. One analysis noted that between Hedera's Q4 2022 treasury report and a subsequent treasury management report, unallocated supply fell from several billion HBAR to just 0.13% of total supply while purchase agreement allocations nearly doubled to 25.4% of total supply. This shift in treasury composition was not widely communicated to retail token holders at the time it occurred. Daily active accounts fell from approximately 10,100 to 6,700 quarter-over-quarter in mid-2025, suggesting user growth has not kept pace with infrastructure development. HBAR's all-time high was approximately $0.57 in September 2021. As of mid-2026, HBAR trades near $0.09, approximately 84% below its all-time high. The token reached $0.39–$0.40 in late 2024 and January 2025 before declining over 70% by the end of Q1 2025.","heading":"Token Economics and Distribution Concerns","sources":[{"url":"https://www.disruptionbanking.com/2025/09/26/hbars-price-vs-adoption-dissecting-whats-holding-the-token-back/","name":"disruptionbanking.com","type":"other","credibility":3},{"url":"https://www.bitget.com/academy/hbar-hedera-guide","name":"bitget.com","type":"other","credibility":3},{"url":"https://coinmarketcap.com/currencies/hedera/","name":"coinmarketcap.com","type":"other","credibility":3}],"severity":"medium"},{"content":"The hashgraph consensus algorithm was invented by Dr. Leemon Baird and originally held as patented intellectual property by Swirlds, Inc., the company co-founded by Baird and Mance Harmon. Swirlds held three U.S. patents protecting the platform, granted in 2016. Hedera operated under an exclusive license to the technology, and the codebase was initially closed source, which generated ongoing criticism from the open-source developer community and raised questions about long-term auditability and permissionless development. In January 2022, the Hedera Governing Council voted to purchase the hashgraph IP rights from Swirlds, Inc. The Council subsequently committed to releasing the codebase under the Apache 2.0 open-source license. The transition to open source was completed on August 5, 2022. Concurrent with this transition, Mance Harmon and Dr. Leemon Baird departed their executive roles at Hedera Hashgraph, LLC and continued their involvement in the ecosystem through Swirlds as peer members of the Governing Council. Critics noted that the closed-source period spanning the network's 2019 launch through 2022 represented a significant window during which independent audit of the consensus code was not possible.","heading":"Intellectual Property History and Open Source Transition","sources":[{"url":"https://hedera.com/blog/hedera-governing-council-votes-to-purchase-hashgraph-ip-commits-to-open-source-worlds-most-advanced-distributed-ledger-technology/","name":"hedera.com","type":"other","credibility":3},{"url":"https://www.prnewswire.com/news-releases/hedera-governing-council-votes-to-purchase-hashgraph-ip-commits-to-open-source-worlds-most-advanced-distributed-ledger-technology-301463865.html","name":"prnewswire.com","type":"other","credibility":3},{"url":"https://cryptobriefing.com/legal-analysis-can-patent-law-protect-hedera-hashgraph/","name":"cryptobriefing.com","type":"other","credibility":3}],"severity":"medium"},{"content":"As of 2026, HBAR has not been formally classified as a security by the U.S. Securities and Exchange Commission. Hedera's own regulatory disclosures have acknowledged that the company has neither sought nor received a no-action letter or other official relief from the SEC or any other regulatory body. The emergence of the CLARITY Act in 2025-2026 legislative proceedings has been cited as a potential mechanism to permanently resolve the commodity versus security question for HBAR. A Grayscale spot HBAR ETF application was under SEC review as of late 2025, with a November 12, 2025 deadline set by the SEC for its decision. A Canary Capital HBAR ETF launched in October 2025 and accumulated approximately $93 million in net inflows. An S-1 registration statement for an HBAR-related product was filed with the SEC in 2025. Hedera has historically positioned HBAR as deriving value from protocol operation and market supply-and-demand rather than from the managerial efforts of any central party, which is the primary argument against securities classification.","heading":"Regulatory Status","sources":[{"url":"https://coinpedia.org/news/clarity-act-could-permanently-end-the-secs-war-against-xrp-ada-hbar-and-xlm/","name":"coinpedia.org","type":"other","credibility":3},{"url":"https://crypto.news/sec-deadline-grayscale-spot-hbar-etf-decision-2025/","name":"crypto.news","type":"other","credibility":3},{"url":"https://www.sec.gov/Archives/edgar/data/2084948/000095017025113803/hbar-20250909.htm","name":"sec.gov","type":"other","credibility":3},{"url":"https://help.hedera.com/hc/en-us/articles/360002542738-Will-regulators-deem-hbars-to-be-securities","name":"help.hedera.com","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2016","event":"Swirlds, Inc. granted three U.S. patents protecting the hashgraph consensus algorithm invented by Dr. Leemon Baird.","source":"","date_original":"2016-01-01"},{"date":"2019-09-16","event":"Hedera mainnet launched for open public access with HBAR as the native token.","source":""},{"date":"2021-09-15","event":"HBAR reached its all-time high price of approximately $0.57 USD.","source":""},{"date":"2022-01-19","event":"Hedera Governing Council voted to purchase the hashgraph intellectual property from Swirlds, Inc. and committed to releasing it under the Apache 2.0 open-source license.","source":""},{"date":"2022-08-05","event":"Hedera codebase transitioned to open source under Apache 2.0, completing the IP acquisition and open-sourcing commitment.","source":""},{"date":"2022-11","event":"Prolific scammer (account '2015717') allegedly began mass airdrop phishing campaigns targeting Hedera wallet users, sending fraudulent memos to tens of thousands of accounts.","source":"","date_original":"2022-11-01"},{"date":"2023-03-09","event":"Attacker exploited a delegatecall precompile bug in Hedera's Smart Contract Service, stealing approximately $600,000 in tokens (DAI, USDT, USDC, WHBAR) from liquidity pools at Pangolin, SaucerSwap, and HeliSwap. Mainnet proxy access disabled at 20:18 UTC.","source":""},{"date":"2023-03-11","event":"Hedera mainnet upgraded with patch (version 0.34.5) blocking delegateCall to HTS precompile contracts; full service restored at 02:04 UTC, 41 hours after initial attack discovery.","source":""},{"date":"2024-11-15","event":"Hedera Governing Council approved governance reforms, reducing board size from seven to five members with two unaffiliated seats.","source":""},{"date":"2025","event":"HBAR reached approximately $0.40, a multi-year high driven by post-election crypto rally, before declining over 70% by end of Q1 2025.","source":"","date_original":"2025-01-01"},{"date":"2025-10","event":"Canary Capital HBAR ETF launched, accumulating approximately $93 million in net inflows.","source":"","date_original":"2025-10-01"},{"date":"2025-06-03","event":"FBI Internet Crime Complaint Center (IC3) issued formal public service announcement warning of cybercriminals defrauding Hedera Hashgraph non-custodial wallet users through NFT airdrop phishing schemes.","source":""}],"sources_used":[{"url":"https://en.wikipedia.org/wiki/Hedera_(distributed_ledger)","name":"en.wikipedia.org","type":"other","archive_url":"http://web.archive.org/web/20260819075317/https://en.wikipedia.org/wiki/Hedera_(distributed_ledger)","credibility":3,"archive_timestamp":"2026-08-19T07:53:17+00:00"},{"url":"https://hedera.com/blog/analysis-remediation-of-the-precompile-attack-on-the-hedera-network/","name":"hedera.com","type":"other","archive_url":"http://web.archive.org/web/20260607234426/https://hedera.com/blog/analysis-remediation-of-the-precompile-attack-on-the-hedera-network/","credibility":3,"archive_timestamp":"2026-06-07T23:44:26+00:00"},{"url":"https://www.bitget.com/academy/hedera-hbar-blockchain","name":"bitget.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:not-found","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.theblock.co/post/218714/hedera-confirms-hackers-stole-tokens-from-dexs-exploiting-a-bug-in-smart-contract-service","name":"theblock.co","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://medium.com/pangolin-exchange/postmortem-the-march-9th-hack-on-hedera-6b5f9963c4fa","name":"medium.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.coindesk.com/business/2023/03/09/hedera-turns-off-services-after-network-irregularities","name":"coindesk.com","type":"other","archive_url":"http://web.archive.org/web/20260218125704/https://www.coindesk.com/business/2023/03/09/hedera-turns-off-services-after-network-irregularities","credibility":3,"archive_timestamp":"2026-02-18T12:57:04+00:00"},{"url":"https://www.ic3.gov/PSA/2025/PSA250603","name":"ic3.gov","type":"other","archive_url":"http://web.archive.org/web/20260625001930/https://www.ic3.gov/PSA/2025/PSA250603","credibility":3,"archive_timestamp":"2026-06-25T00:19:30+00:00"},{"url":"https://www.fbi.gov/investigate/cyber/alerts/2025/cybercriminals-defraud-hedera-hashgraph-network-non-custodial-wallet-users-through-nonfungible-token-airdrops-disguised-as-free-rewards","name":"fbi.gov","type":"other","archive_url":"http://web.archive.org/web/20260128005113/https://www.fbi.gov/investigate/cyber/alerts/2025/cybercriminals-defraud-hedera-hashgraph-network-non-custodial-wallet-users-through-nonfungible-token-airdrops-disguised-as-free-rewards","credibility":3,"archive_timestamp":"2026-01-28T00:51:13+00:00"},{"url":"https://www.bleepingcomputer.com/news/security/fbi-warns-of-nft-airdrop-scams-targeting-hedera-hashgraph-wallets/","name":"bleepingcomputer.com","type":"other","archive_url":"http://web.archive.org/web/20260217003115/https://www.bleepingcomputer.com/news/security/fbi-warns-of-nft-airdrop-scams-targeting-hedera-hashgraph-wallets/","credibility":3,"archive_timestamp":"2026-02-17T00:31:15+00:00"},{"url":"https://www.hashpack.app/community-blog/hederas-march-9-exploiter-a-prolific-scammer-within-the-hedera-ecosystem","name":"hashpack.app","type":"other","archive_url":"http://web.archive.org/web/20260510075513/https://www.hashpack.app/community-blog/hederas-march-9-exploiter-a-prolific-scammer-within-the-hedera-ecosystem","credibility":3,"archive_timestamp":"2026-05-10T07:55:13+00:00"},{"url":"https://hederacouncil.org/","name":"hederacouncil.org","type":"other","archive_url":"http://web.archive.org/web/20260614224608/https://hederacouncil.org/","credibility":3,"archive_timestamp":"2026-06-14T22:46:08+00:00"},{"url":"https://hedera.com/blog/a-new-era-for-hedera/","name":"hedera.com","type":"other","archive_url":"http://web.archive.org/web/20260512154100/https://hedera.com/blog/a-new-era-for-hedera/","credibility":3,"archive_timestamp":"2026-05-12T15:41:00+00:00"},{"url":"https://arxiv.org/pdf/2311.06865","name":"arxiv.org","type":"other","archive_url":"https://web.archive.org/web/20260829224655/https://arxiv.org/pdf/2311.06865","credibility":3,"archive_timestamp":"2026-08-29T22:46:55+00:00"},{"url":"https://allincrypto.com/understanding-hederas-governing-council-and-its-impact-on-decentralization/","name":"allincrypto.com","type":"other","archive_url":"https://web.archive.org/web/20260829112203/https://allincrypto.com/understanding-hederas-governing-council-and-its-impact-on-decentralization/","credibility":3,"archive_timestamp":"2026-08-29T11:22:03+00:00"},{"url":"https://www.disruptionbanking.com/2025/09/26/hbars-price-vs-adoption-dissecting-whats-holding-the-token-back/","name":"disruptionbanking.com","type":"other","archive_url":"http://web.archive.org/web/20250926075003/https://www.disruptionbanking.com/2025/09/26/hbars-price-vs-adoption-dissecting-whats-holding-the-token-back/","credibility":3,"archive_timestamp":"2025-09-26T07:50:03+00:00"},{"url":"https://www.bitget.com/academy/hbar-hedera-guide","name":"bitget.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:not-found","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://coinmarketcap.com/currencies/hedera/","name":"coinmarketcap.com","type":"other","archive_url":"http://web.archive.org/web/20260809063846/https://coinmarketcap.com/currencies/hedera/","credibility":3,"archive_timestamp":"2026-08-09T06:38:46+00:00"},{"url":"https://hedera.com/blog/hedera-governing-council-votes-to-purchase-hashgraph-ip-commits-to-open-source-worlds-most-advanced-distributed-ledger-technology/","name":"hedera.com","type":"other","archive_url":"http://web.archive.org/web/20260826082537/https://hedera.com/blog/hedera-governing-council-votes-to-purchase-hashgraph-ip-commits-to-open-source-worlds-most-advanced-distributed-ledger-technology/","credibility":3,"archive_timestamp":"2026-08-26T08:25:37+00:00"},{"url":"https://www.prnewswire.com/news-releases/hedera-governing-council-votes-to-purchase-hashgraph-ip-commits-to-open-source-worlds-most-advanced-distributed-ledger-technology-301463865.html","name":"prnewswire.com","type":"other","archive_url":"http://web.archive.org/web/20260410084640/https://www.prnewswire.com/news-releases/hedera-governing-council-votes-to-purchase-hashgraph-ip-commits-to-open-source-worlds-most-advanced-distributed-ledger-technology-301463865.html","credibility":3,"archive_timestamp":"2026-04-10T08:46:40+00:00"},{"url":"https://cryptobriefing.com/legal-analysis-can-patent-law-protect-hedera-hashgraph/","name":"cryptobriefing.com","type":"other","archive_url":"http://web.archive.org/web/20251209012014/https://cryptobriefing.com/legal-analysis-can-patent-law-protect-hedera-hashgraph/","credibility":3,"archive_timestamp":"2025-12-09T01:20:14+00:00"},{"url":"https://coinpedia.org/news/clarity-act-could-permanently-end-the-secs-war-against-xrp-ada-hbar-and-xlm/","name":"coinpedia.org","type":"other","archive_url":"https://web.archive.org/web/20260829025926/https://coinpedia.org/news/clarity-act-could-permanently-end-the-secs-war-against-xrp-ada-hbar-and-xlm/","credibility":3,"archive_timestamp":"2026-08-29T02:59:26+00:00"},{"url":"https://crypto.news/sec-deadline-grayscale-spot-hbar-etf-decision-2025/","name":"crypto.news","type":"other","archive_url":"http://web.archive.org/web/20251228165802/https://crypto.news/sec-deadline-grayscale-spot-hbar-etf-decision-2025/","credibility":3,"archive_timestamp":"2025-12-28T16:58:02+00:00"},{"url":"https://www.sec.gov/Archives/edgar/data/2084948/000095017025113803/hbar-20250909.htm","name":"sec.gov","type":"other","archive_url":"http://web.archive.org/web/20260519105041/https://www.sec.gov/Archives/edgar/data/2084948/000095017025113803/hbar-20250909.htm","credibility":3,"archive_timestamp":"2026-05-19T10:50:41+00:00"},{"url":"https://help.hedera.com/hc/en-us/articles/360002542738-Will-regulators-deem-hbars-to-be-securities","name":"help.hedera.com","type":"other","archive_url":"http://web.archive.org/web/20251006203052/https://help.hedera.com/hc/en-us/articles/360002542738-Will-regulators-deem-hbars-to-be-securities","credibility":3,"archive_timestamp":"2025-10-06T20:30:52+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":true,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:26.36215+00:00","updated_at":"2026-08-29T23:26:13.242736+00:00"}}