Blockchain security firm ZeroShadow said the crypto sector lost about $97 million to security incidents in July 2026, with losses rising roughly 18.7% from $81.73 million in June. Of that total, around $94 million came from hacker attacks and contract-related flaws, while phishing accounted for about $3 million. The report counted more than 14 protocol-related incidents, down from 67 in June, but noted that the amount lost per incident rose sharply. Cross-chain bridges remained the hardest-hit area. AFX Trade, Verus and B² Network were among the projects hit within a matter of hours, with combined losses exceeding $35 million. ZeroShadow said the main attack path is shifting away from smart-contract coding bugs and toward off-chain infrastructure compromises, validator or signing-key leaks, and governance manipulation. The report highlighted seven major hacking cases, including the $23.75 million Ostium exploit tied to compromised off-chain price-signing infrastructure, the $24.15 million AFX Trade bridge attack involving validator keys, and the $20 million BonkDAO treasury drain carried out through governance rules rather than contract failure. It also listed four notable phishing or scam incidents and offered separate recommendations for users, project teams and the broader industry.

On July 11, 2026, Hedera-based DeFi lending protocol Bonzo Lend suffered an oracle manipulation exploit, losing ~$9 million. The attacker deposited just 250 SAUCE (worth a few dollars), manipulated its price by 12 orders of magnitude via a Supra verifier flaw, and drained USDC and wrapped HBAR.

Bonzo Lend, a lending protocol built on Hedera, remains paused after an oracle verifier accepted a proof containing a zero signature and a zero public key, allowing one wallet to borrow roughly $9.05 million against 250 SAUCE worth only a few dollars. According to the incident review cited in the report, wallet A posted a manipulated SAUCE/wHBAR price update at 00:51 UTC, inflating the token’s value by about 12 orders of magnitude while the market price stayed near 0.2 HBAR. Eight seconds after the bad price reached onchain oracle storage, the wallet borrowed 6.63 million USDC and then 34.5 million wrapped HBAR. Bonzo said its lending contracts simply used the stored oracle price and executed under the protocol’s loan-to-value rules. A second wallet borrowed about $1 million while the abnormal price remained active, then contacted Bonzo and identified itself as a white hat responder that intended to return the funds. Bonzo said about $1 million has been recovered in its accounting, though the money has not yet been returned and the final amount is still uncertain. Supra has fixed the verifier, but Bonzo Lend, Bonzo Points, and withdrawals were still suspended as of July 13.

Bonzo Lend, a lending protocol on Hedera, was exploited on July 11 after an attacker abused a verification flaw in a third-party Supra oracle contract. Bonzo’s preliminary incident report said the attacker posted 250 SAUCE tokens worth only a few dollars as collateral, then pushed a manipulated price update that sharply inflated the token’s value against HBAR. That account went on to borrow 6.63 million USDC and 34.52 million wrapped HBAR, worth about $9.05 million at the report’s reference HBAR price. A second wallet borrowed roughly $1 million more while the abnormal price remained live, then contacted Bonzo on Discord, described itself as a white-hat responder, and said the funds would be returned. That brought total abnormal borrowing to about $10.06 million before any return. Bonzo later said its protocol had been paused and remains paused while recovery work continues. Supra Labs said the incident stemmed from a degenerate BLS signature and a zero-valued public key that its Hedera verifier incorrectly accepted for a single SAUCE/wHBAR feed, adding that its core aggregation system and other feeds were not affected. After the exploit, Hedera’s TVL dropped nearly 40% over 24 hours, while Bonzo’s TVL fell 77%. DefiLlama now lists Bonzo at $3.06 million in TVL.

Bonzo Finance, a lending protocol built on Hedera, lost about $9 million in an oracle attack, according to Odaily. In its preliminary incident report, the protocol said the attacker deposited just 250 SAUCE tokens, then submitted a price update that artificially inflated SAUCE by roughly 12 orders of magnitude. Using the overstated collateral value, the attacker borrowed assets far beyond their real worth from the lending pool. Bonzo Finance said the address went on to borrow 6.63 million USDC and 34.5 million wrapped HBAR. The protocol added that the incident was not caused by a flaw in Bonzo Finance’s smart contracts or in the Hedera base network itself. Instead, it traced the issue to a vulnerability in the on-chain oracle validator operated by oracle provider Supra. According to the report, Supra’s validator incorrectly accepted SAUCE price data with a zeroed signature. Supra has since confirmed the issue and completed a fix. The case highlights how oracle failures can expose lending markets even when the core protocol logic is not identified as the direct source of the exploit.

SaucerSwap is an open-source, non-custodial AMM on Hedera offering liquidity provision, yield farming, and single-sided staking. Its native token SAUCE has a circulating supply of 903,443,445 and a maximum supply of 1 billion.

SaucerSwap is an open-source, non-custodial AMM protocol on Hedera. Its native token SAUCE has a circulating supply of 903M (max 1B) and an ATH of $0.23. This article explores its tech, tokenomics, and market outlook.

SaucerSwap is an open-source, non-custodial AMM on Hedera offering liquidity provision, yield farming, and single-sided staking. Its native token SAUCE once reached an all-time high of $0.23, with about 903.4 million tokens in circulation out of a 1 billion max supply.