LayerZero Confirms $2.4M Executor Wallet Transfers Were Routine Rebalancing, Not Hack

LayerZero has confirmed that roughly $2.4 million moved from its Executor wallets across multiple blockchains was part of routine operational rebalancing, putting to rest concerns that the protocol had suffered a security breach.

The transfers, first flagged by blockchain security firm PeckShield on July 15, drew attention after funds were moved from Executor wallets on BNB Chain, Base, Arbitrum, Avalanche, Optimism, Mantle, Plasma and Ethereum before being bridged back to Ethereum.

Update: This is NOT an attack. The fund movement was part of normal operational rebalancing. No user funds at risk.

— PeckShield (@PeckShield) July 15, 2026

The activity quickly renewed speculation of a possible exploit as on-chain analysts tracked the movement of funds across several networks.

Why did the transfers trigger hack concerns?

According to PeckShield, the funds were transferred through LayerZero’s own infrastructure, including Stargate and Relay, before being consolidated on Ethereum.

On-chain analyst Specter also tracked the transactions, identifying the addresses involved as the assets were converted into about 956 ETH, worth around $1.79 million at the time, alongside approximately $322,000 in USDC.

The large-scale movement across several chains, combined with the rapid asset swaps, led some market participants to suspect the protocol’s infrastructure had been compromised.

LayerZero says funds were moved for routine operations

LayerZero later confirmed that the transfers were not the result of an exploit or unauthorized access.

According to the protocol, the transactions were part of normal treasury management designed to rebalance liquidity held in Executor wallets. The funds were consolidated to support ongoing protocol operations, with no disruption to LayerZero’s services.

Executor wallets are responsible for carrying out verified cross-chain messages and maintaining liquidity needed for the protocol’s cross-chain infrastructure. Meanwhile, $ZRO, the native token of LayerZero’s “Zero” L1 chain, has seen significant accumulation from institutional wallets, signalling growing conviction ahead of a major unlock.

Protocol continues normal operations

Following the clarification, there is no indication that user funds were affected or that the protocol’s security was compromised.

This shows how large transfers from infrastructure wallets can trigger security concerns before official explanations are available. Blockchain security firms and on-chain analysts often flag unusual activity quickly, allowing the wider crypto community to monitor transactions in real time.

LayerZero said the protocol remains fully operational as developers and users continue to monitor its cross-chain infrastructure following the routine fund rebalancing.