Bonzo Lend loses $9.05M in Hedera oracle exploit

The Bonzo Lend protocol, the largest decentralized lending platform on the Hedera blockchain, suffered a loss of approximately $9.05 million on July 11, 2026, due to an exploit of a third-party oracle service. The incident forced the protocol to pause its lending pool and rewards program to prevent further losses.

According to a preliminary incident report from Bonzo Finance Labs, the exploit was caused by a flaw in the on-chain oracle verifier operated by Supra, the protocol's price feed provider. An attacker, identified as Wallet A, deposited 250 SAUCE tokens, worth only a few dollars, into the protocol. The attacker then submitted a manipulated price update that inflated the reported value of SAUCE by roughly twelve orders of magnitude. Because Supra's verifier incorrectly accepted this update due to a zeroed cryptographic signature, the Bonzo Lend system processed the false price as valid.

With the artificially inflated collateral valuation in place, Wallet A was able to borrow 6.63 million USDC and over 34.5 million wrapped HBAR from the lending pool within minutes, far exceeding the true value of the deposited SAUCE. The total economic impact is estimated at $9.05 million....