Bonzo Lend loses $9 million due to oracle exploit on Hedera

The largest lending protocol on the Hedera network, Bonzo Lend, has fallen victim to a serious oracle exploit. Due to a flaw in the signature verification of oracle provider Supra, an attacker manages to manipulate SAUCE prices and subsequently borrow millions of dollars worth of assets with insufficient collateral. The total damage amounts to approximately $9.05 million. The protocol has been temporarily halted.

How the attacker exploited the system

On 11 July 2026, Bonzo Finance Labs published a comprehensive incident report in collaboration with the Bonzo Finance Foundation. In it, the team explains that the problem lies in a flaw in the way Supra’s signature verification works. This flaw allows the attacker to feed fake prices for the SAUCE token, after which the protocol accepts that manipulated price data as valid.

Based on those inflated prices, the attacker borrows a multiple of the actual collateral. This type of exploit via price manipulation is not new in the DeFi world, but it is striking that the Hedera network is once again hit by a major attack. Previously, the network was already in the news due to a similar incident in which attackers stole hundreds of millions, as previously reported.

Protocol paused while recovery begins

After discovering the exploit, Bonzo Lend paused all activities. Bonzo Finance Labs and the Bonzo Finance Foundation are working closely on recovery measures and further communication to users. In the report, the team indicates its desire to be transparent about the findings of the ongoing investigation.

The incident affects both individual users and institutions active within the Hedera ecosystem and reliant on Bonzo Finance’s DeFi services. The team states that this report is only the beginning of the communication and that further updates will follow as the investigation progresses.