Bonzo Lend hit by more than $10 million in abnormal borrowing after Supra oracle flaw on Hedera

News Editor

2026-07-13 19:48:08

Bonzo Lend, a lending protocol on Hedera, was exploited on July 11 after an attacker abused a verification flaw in a third-party Supra oracle contract. Bonzo’s preliminary incident report said the attacker posted 250 SAUCE tokens worth only a few dollars as collateral, then pushed a manipulated price update that sharply inflated the token’s value against HBAR. That account went on to borrow 6.63 million USDC and 34.52 million wrapped HBAR, worth about $9.05 million at the report’s reference HBAR price. A second wallet borrowed roughly $1 million more while the abnormal price remained live, then contacted Bonzo on Discord, described itself as a white-hat responder, and said the funds would be returned. That brought total abnormal borrowing to about $10.06 million before any return. Bonzo later said its protocol had been paused and remains paused while recovery work continues. Supra Labs said the incident stemmed from a degenerate BLS signature and a zero-valued public key that its Hedera verifier incorrectly accepted for a single SAUCE/wHBAR feed, adding that its core aggregation system and other feeds were not affected. After the exploit, Hedera’s TVL dropped nearly 40% over 24 hours, while Bonzo’s TVL fell 77%. DefiLlama now lists Bonzo at $3.06 million in TVL.

Bonzo LendHederaSupraoracle exploitDeFi hackTVLLayerZero

Bonzo Lend, a lending protocol on the Hedera network, was exploited on July 11 after an attacker abused a verification flaw in a third-party Supra oracle contract. Bonzo’s preliminary incident report put the loss at about $9.05 million.

Small collateral, large borrowing

According to Bonzo, the attacker first deposited 250 SAUCE tokens as collateral. The tokens were worth only a few dollars. The attacker then submitted a manipulated price update that inflated the token’s HBAR-denominated value.

Once the distorted price was accepted, the account borrowed 6.63 million USDC and 34.52 million wrapped HBAR. Using the reference HBAR price in Bonzo’s report, the borrowed assets were worth roughly $9.05 million.

Second wallet raised the total to about $10.06 million

While the abnormal price remained in place, a second wallet borrowed roughly $1 million more. That wallet later contacted Bonzo through Discord, identified itself as a white-hat responder, and said it would return the funds.

Before any return, total abnormal borrowing reached about $10.06 million.

Bonzo paused the protocol, Supra published its own report

Bonzo said on X that the lending protocol had been temporarily paused while the team investigated volatile markets. It later confirmed the protocol remains paused as recovery work continues.

Supra Labs, whose oracle contract processed the faulty price, said the issue was caused by a degenerate BLS signature and a zero-valued public key that its Hedera verifier incorrectly accepted for a single SAUCE/wHBAR feed. Supra added that its core aggregation system and other feeds were unaffected.

TVL dropped across Bonzo and the wider Hedera ecosystem

After the exploit, Hedera’s total value locked fell nearly 40% over 24 hours. Bonzo’s own TVL dropped 77% in the same period. DefiLlama now shows Bonzo with $3.06 million in TVL.

More than $5.25 million moved to Ethereum

A security researcher’s technical writeup said more than $5.25 million of the stolen funds was bridged to Ethereum through LayerZero and swapped into ETH within hours.

This article was originally published by Bit.Fan. For more cryptocurrency news and market insights, visit www.bit.fan.

200

Disclaimer:

The market information, project data, and third-party content displayed on this platform are for industry information sharing only and do not constitute any form of investment advice or return commitment.

Cryptocurrency trading carries high risks. Users should fully assess their risk tolerance and make independent decisions. All profits, losses, and legal responsibilities are borne by the users themselves.