Bonzo Finance Labs said users affected by the July 11 oracle attack on Bonzo Lend will receive full reimbursement. The compensation will be calculated based on each user’s position status before the incident took place, according to the company’s statement. Bonzo Finance also said the payout will be backed by a recovery mechanism committed by the Hedera Foundation. The statement addresses the impact of the attack on Bonzo Lend and sets out how affected users will be compensated. No additional details on the reimbursement timetable were disclosed in the brief update.

Bonzo Finance Labs said in a post on X that the Bonzo Finance Foundation will provide full reimbursement following the July 11 oracle attack that affected Bonzo Lend. The compensation will be calculated based on users’ position status before the incident. According to the statement, the funds for the reimbursement will be backed by a recovery mechanism pledged by the Hedera Foundation. The update addresses the fallout from the attack and outlines how the project plans to cover affected positions.

On-chain activity reviewed after the Bonzo Lend exploit suggests Supra Network had already rolled out the same oracle fix across 11 other chains before the vulnerable Hedera deployment was updated. Bonzo Lend said the oracle accepted an extreme mispricing of the attacker’s collateral asset, allowing the attacker to borrow far more than the collateral was actually worth. Roughly $9 million was taken in the weekend exploit, and another $1 million was later extracted by a white-hat hacker. The oracle came from Supra, which says its feeds are live on 67 mainnets. After the attack, Plasma’s Usmann Khan said Supra had upgraded several oracle implementations in the days before the exploit but had not updated the Hedera contract Bonzo Lend relied on. HSuite founder Tomachi Anura later said on-chain records show proxy upgrades on 11 chains from June 29 through July 3, with Hedera and Fuse patched only after the exploit. Supra’s incident report described the bug as a “cryptographic edge case,” while co-founder and CEO Josh Tobkin said “AI-assisted hacking” had found what “human eyes had missed” for two years. Protos said it has asked Supra for clarification.

Bonzo Lend, a lending protocol built on Hedera, remains paused after an oracle verifier accepted a proof containing a zero signature and a zero public key, allowing one wallet to borrow roughly $9.05 million against 250 SAUCE worth only a few dollars. According to the incident review cited in the report, wallet A posted a manipulated SAUCE/wHBAR price update at 00:51 UTC, inflating the token’s value by about 12 orders of magnitude while the market price stayed near 0.2 HBAR. Eight seconds after the bad price reached onchain oracle storage, the wallet borrowed 6.63 million USDC and then 34.5 million wrapped HBAR. Bonzo said its lending contracts simply used the stored oracle price and executed under the protocol’s loan-to-value rules. A second wallet borrowed about $1 million while the abnormal price remained active, then contacted Bonzo and identified itself as a white hat responder that intended to return the funds. Bonzo said about $1 million has been recovered in its accounting, though the money has not yet been returned and the final amount is still uncertain. Supra has fixed the verifier, but Bonzo Lend, Bonzo Points, and withdrawals were still suspended as of July 13.

Bonzo Lend, a lending protocol on Hedera, was exploited on July 11 after an attacker abused a verification flaw in a third-party Supra oracle contract. Bonzo’s preliminary incident report said the attacker posted 250 SAUCE tokens worth only a few dollars as collateral, then pushed a manipulated price update that sharply inflated the token’s value against HBAR. That account went on to borrow 6.63 million USDC and 34.52 million wrapped HBAR, worth about $9.05 million at the report’s reference HBAR price. A second wallet borrowed roughly $1 million more while the abnormal price remained live, then contacted Bonzo on Discord, described itself as a white-hat responder, and said the funds would be returned. That brought total abnormal borrowing to about $10.06 million before any return. Bonzo later said its protocol had been paused and remains paused while recovery work continues. Supra Labs said the incident stemmed from a degenerate BLS signature and a zero-valued public key that its Hedera verifier incorrectly accepted for a single SAUCE/wHBAR feed, adding that its core aggregation system and other feeds were not affected. After the exploit, Hedera’s TVL dropped nearly 40% over 24 hours, while Bonzo’s TVL fell 77%. DefiLlama now lists Bonzo at $3.06 million in TVL.

Odaily’s latest morning roundup collected a series of market and crypto industry developments. Tom Lee said that while war has made investors uneasy, the U.S. economy can still achieve a V-shaped recovery. Another item noted that storage chip stocks have fallen more than 20% in recent weeks, with their underlying investment logic facing reassessment. Grayscale said Ethereum, Solana, BNB Chain, Avalanche, and Canton Network could benefit from stock tokenization. In infrastructure news, the Sui Tunnels AI agent experiment set a record with actual TPS reaching 6.086766 million. Metaplanet, which holds 43,000 BTC, is studying digital bonds backed by Bitcoin. Elsewhere, Robinhood Chain’s single-day DEX trading volume surpassed Solana. On the security side, a Russian man was kidnapped in Bali, held for 30 hours, and forced to hand over his crypto accounts, while Hedera-based lending protocol Bonzo Finance suffered an oracle attack with losses of about $9 million.

Bonzo, a lending protocol on Hedera, has suffered an oracle attack that resulted in losses of about $9.05 million, according to Techub, which cited Wu Blockchain. The report said the attacker manipulated data and drained funds by exploiting a flaw tied to Supra signatures. Bonzo has confirmed the incident and said the root cause was a defect in Supra’s signature verification. The team has not yet released a follow-up response plan. The incident has also drawn fresh attention from the community to oracle security, especially around data integrity and signature verification in DeFi systems. No additional recovery steps or mitigation details were disclosed in the source material.

Bonzo Finance, a lending protocol built on Hedera, lost about $9 million in an oracle attack, according to Odaily. In its preliminary incident report, the protocol said the attacker deposited just 250 SAUCE tokens, then submitted a price update that artificially inflated SAUCE by roughly 12 orders of magnitude. Using the overstated collateral value, the attacker borrowed assets far beyond their real worth from the lending pool. Bonzo Finance said the address went on to borrow 6.63 million USDC and 34.5 million wrapped HBAR. The protocol added that the incident was not caused by a flaw in Bonzo Finance’s smart contracts or in the Hedera base network itself. Instead, it traced the issue to a vulnerability in the on-chain oracle validator operated by oracle provider Supra. According to the report, Supra’s validator incorrectly accepted SAUCE price data with a zeroed signature. Supra has since confirmed the issue and completed a fix. The case highlights how oracle failures can expose lending markets even when the core protocol logic is not identified as the direct source of the exploit.