Bonzo Lend loses $9M in oracle exploit on Hedera
Reported by Cointelegraph · AI-assisted summary by ChikoCorp AI News Desk
AI-generated summary based on the linked source; not independently verified. This is not investment advice. Verify market-moving details at the original publisher before acting. See our editorial policy, AI content policy, and financial disclaimer.
Summary
The Hedera-based lending protocol Bonzo Lend suffered a loss of approximately $9 million after an attacker exploited a vulnerability involving the price oracle for the SAUCE token used as collateral. According to a preliminary report from Bonzo, the attacker deposited 250 SAUCE tokens, worth only a few dollars, and then manipulated the onchain oracle verifier to dramatically inflate the token’s value by about 12 orders of magnitude. This allowed the attacker to borrow 6.63 million USDC and 34.5 million wrapped HBAR from the lending pool far beyond the legitimate collateral value.
Bonzo attributed the incident to a flaw in Supra’s onchain oracle verifier, which accepted a manipulated price update carrying a zeroed signature—essentially an empty digital signature that bypassed normal verification. Supra acknowledged the problem and has deployed a fix. Importantly, Bonzo emphasized that the issue was not rooted in vulnerabilities in its own contracts or the Hedera network but arose from the oracle infrastructure. This case highlights the risks posed by oracle failures in DeFi, where inaccurate price feeds can enable attackers to drain large liquidity despite otherwise sound protocol operations.
Why it matters
This exploit adds to a broader pattern of security challenges within decentralized finance (DeFi) in 2026. The second quarter saw a record 83 exploits resulting in about $755 million stolen, with many attacks involving compromised administrator privileges, fake token price manipulation, and cross-chain bridge vulnerabilities. The total value locked in DeFi has declined by 39% over the first half of 2026, suggesting that these repeated hacks may be undermining user confidence and contributing to capital outflows from the sector.
The Bonzo Lend attack resembles a similar incident in February on the Stellar blockchain, where attackers manipulated collateral pricing in a YieldBlox DAO lending pool to drain around $10 million. These recurring collateral price manipulation exploits demonstrate ongoing challenges in securing oracles that provide critical pricing data to lending protocols.