Bonzo Lend Suffers $9M Loss from Oracle Exploit on Hedera

On July 11, 2026, Bonzo Lend, a decentralized lending protocol on the Hedera network, experienced a significant security breach resulting in losses of approximately $9 million. An attacker exploited a vulnerability in the third-party oracle provider, Supra, which allowed them to manipulate the price of the SAUCE token. By submitting an inflated price update, the attacker was able to borrow 6.63 million USDC and 34.5 million wrapped HBAR, far exceeding the actual value of their collateral. The exploit stemmed from a flaw in the oracle's signature verification process, which accepted a manipulated price without a valid signature. Bonzo Lend has since paused operations to assess the situation and develop recovery measures. The incident highlights the risks associated with reliance on external oracle systems in decentralized finance. A second account also borrowed funds during the exploit but later identified itself as a white-hat hacker intending to return the assets. Bonzo Finance Labs and the Bonzo Finance Foundation are coordinating recovery efforts and have confirmed that the incident did not originate from vulnerabilities within Bonzo Lend's contracts or the Hedera network.

Key Points: • Bonzo Lend lost approximately $9 million due to an oracle exploit on July 11, 2026. • The attacker manipulated the SAUCE token price through a vulnerability in the Supra oracle's verification process. • Bonzo Lend has paused operations to assess the impact and develop recovery measures.