Lending protocol Bonzo loses 77% of value locked as $9 million oracle exploit rattles Hedera

The decentralized lending protocol Bonzo Lend on the Hedera network experienced a significant security incident resulting in a loss of about $9.05 million. The exploit was carried out by an attacker who abused a verification flaw in a third-party Supra oracle contract. By depositing low-value SAUCE tokens and submitting a manipulated price feed, the attacker artificially inflated the token's value denominated in HBAR, which allowed borrowing far beyond the true collateral value. This manipulation led to the withdrawal of 6.63 million USDC and 34.52 million wrapped HBAR from Bonzo.

In addition to the main attacker, a second wallet exploited the abnormal price and borrowed roughly $1 million in assets. This second party later identified themselves as a white-hat responder intending to return the funds, and as a result, Bonzo did not include these assets in its headline loss figure. Overall, around $10.06 million in principal was borrowed during the incident before any recovery.

The exploit had broader effects on the Hedera ecosystem, with the network's total value locked (TVL) dropping nearly 40% in the 24 hours following the incident, falling to approximately $25.7 million. Bonzo Lend’s own TVL plummeted by 77%, indicating a sharp loss of confidence and likely withdrawals from the platform. This event underscores the risks inherent in DeFi protocols relying on third-party oracles for price data, as oracle manipulation can lead to significant financial damage.

The exploit could lead to heightened scrutiny of oracle security and may prompt Hedera and DeFi projects on its network to review and strengthen their verification processes. Meanwhile, the sizable loss is likely to impact investor confidence and potentially slow down lending activity or capital inflows into the Hedera DeFi ecosystem until trust is rebuilt.