A lending protocol based on Hedera, Bonzo Finance, has suffered an oracle attack, resulting in losses of approximately $9.00 million. The attacker utilized collateral where the SAUCE token price was abnormally inflated to borrow assets from the protocol far exceeding their actual value.

Bonzo's initial incident report indicates that the attacker deposited only 250 SAUCE tokens (worth only a few dollars) and subsequently submitted a price update, artificially inflating the token's price by approximately 12 orders of magnitude. Following this, the address borrowed $6.63 million USDC and 34.50 million wrapped HBAR (wHBAR) from the lending pool.

It is understood that this incident stemmed from a vulnerability in the on-chain oracle validator of oracle service provider Supra, which erroneously accepted SAUCE price data with a zeroed signature.

[PANews]

On July 12 (UTC+8), Bonzo Finance, a lending protocol built on Hedera, suffered an oracle attack, resulting in losses of approximately $9 million. The attacker exploited collateral—SAUCE tokens whose price had been artificially inflated—and borrowed assets from the protocol far exceeding their actual value.

According to Bonzo’s preliminary incident report, the attacker deposited only 250 SAUCE tokens (worth just a few dollars) and then submitted a single price update that artificially inflated the token’s price by roughly 12 orders of magnitude. Subsequently, the attacker borrowed $6.63 million in USDC and 34.5 million wrapped HBAR (wHBAR) from the lending pool.

The incident reportedly originated from a vulnerability in Supra’s on-chain oracle validator, which erroneously accepted SAUCE price data with a zeroed-out signature. Supra has confirmed the issue and completed its fix. Bonzo emphasized that this attack did not stem from any vulnerability in Bonzo’s smart contracts or the underlying Hedera network itself.

Data shows that Q2 2026 has become the quarter with the highest number of attacks in cryptocurrency industry history, with 83 security incidents recorded and total losses amounting to approximately $755 million. Among these, cross-chain bridge attacks accounted for roughly $351 million in losses, while admin key compromises and fake token price manipulation accounted for 37% of the quarter’s total losses.

Amid ongoing security incidents, the DeFi sector’s total value locked (TVL) has declined from approximately $115 billion in January to over $70 billion in June—a cumulative drop of 39%. According to CryptoRank, the industry has experienced 121 security incidents year-to-date, with total losses reaching approximately $942 million. Persistent security issues may further erode user confidence and accelerate capital outflows.

Notably, in February, YieldBlox—a lending protocol in the Stellar ecosystem—experienced a similar incident. The attacker manipulated the USTRY collateral price path to steal approximately $10 million in assets from its lending pool. (Source: PANews)

[ME News]

HBAR

SUPRA

USDC

Bonzo lost approximately $9 million in an oracle attack, where the attacker manipulated the SAUCE price to borrow a large amount of assets.

Bonzo Lend, a decentralized lending protocol on Hedera (HBAR), was hit for roughly $9.05 million late Friday ET after an attacker exploited a vulnerability in a third-party Supra oracle verifier and submitted an artificial price for the SAUCE token, according to a preliminary incident report published by Bonzo.

The protocol paused Bonzo Lend shortly after the attack. Its points program was also halted, while Bonzo’s vaults, bridge and staking products were not affected. Hedera said on X the incident was confined to a third-party oracle verifier and did not involve a flaw in the network’s core infrastructure.

The attacker deposited 250 SAUCE, worth a few dollars, as collateral at around 8:40 p.m. ET Friday, then submitted a price update to Supra's on-demand oracle contract that overstated the token's value by roughly 12 orders of magnitude, according to the report. SAUCE was trading near 0.2 HBAR at the time; the manipulated update carried a figure of 1 followed by 30 zeroes.

Within seconds of the manipulated price landing on-chain at 8:51 p.m. ET, the wallet borrowed roughly 6.63 million USDC and 34.5 million wrapped HBAR against the near-worthless deposit. Bonzo valued the extracted principal at approximately $9.05 million using an HBAR reference price of about $0.07.

The fake price update carried a cryptographic signature made up entirely of zeros. Supra’s verifier should have rejected it immediately, but instead treated it as valid because of a flaw in how the contract checked signatures.

That allowed the attacker to submit a price without approval from Supra’s legitimate signers. Put simply, the attacker did not crack Supra’s cryptography or steal a signing key; rather, they found a way to make the verifier accept an obviously invalid update.

Bonzo said Supra acknowledged the issue and deployed a fix to the affected verifier contract on Hedera mainnet. "It is because of that fix, and the resulting ability to inspect the contract's behavior, that we are able to describe the mechanism," the Bonzo team wrote.

A second wallet borrowed about $1 million while the bad price was live, then contacted the team, identified itself as a white-hat responder and said it intended to return the funds. Bonzo excluded that amount from its headline figure, which would otherwise total roughly $10.06 million.

Onchain investigator Specter first flagged suspicious fund movements from Hedera to Ethereum before Bonzo confirmed the source of the exploit. Legitimate oracle update restored SAUCE's price at 9:36 p.m. ET Friday, and Bonzo paused its lending pool five minutes later.

The incident extends a heavy year for crypto exploits, with projects losing roughly $972 million across a record 207 incidents in the first half of 2026, according to Immunefi. It also fits a broader shift toward infrastructure failures, private-key compromises and privileged-access weaknesses outside an affected application’s core contracts, a dynamic seen in the suspected Gravity Bridge key compromise and Kelp DAO’s bridge-verification exploit.

Disclaimer: The Block is an independent media outlet that delivers news, research, and data. As of November 2023, Foresight Ventures is a majority investor of The Block. Foresight Ventures invests in other companies in the crypto space. Crypto exchange Bitget is an anchor LP for Foresight Ventures. The Block continues to operate independently to deliver objective, impactful, and timely information about the crypto industry. Here are our current financial disclosures.

© 2026 The Block. All Rights Reserved. This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.

Hedera lending protocol Bonzo Lend hit for $9 million after Supra verifier accepts manipulated price update

Bonzo lost approximately $9.00 million due to an oracle attack, with the attacker manipulating the SAUCE price to borrow a huge amount of assets.

Bonzo Finance, a lending protocol built on Hedera, suffered an oracle attack, resulting in losses of approximately $9 million. The attacker exploited collateral consisting of SAUCE tokens whose price had been artificially inflated, borrowing assets from the protocol far exceeding their actual value. According to Bonzo Finance’s preliminary incident report, the attacker deposited only 250 SAUCE tokens, then submitted a single price update that artificially inflated the token’s price by roughly 12 orders of magnitude. Subsequently, the attacker borrowed 6.63 million USDC and 34.5 million wrapped HBAR from the lending pool.

This attack did not stem from vulnerabilities in Bonzo Finance’s smart contracts or the underlying Hedera network itself, but rather from a vulnerability in Supra’s on-chain oracle validator—the oracle service provider—which erroneously accepted a SAUCE price data point with a zeroed-out signature. Supra has since confirmed the issue and completed the fix.

[Odaily]

Losses of approximately $9.00 million, Hedera ecosystem lending protocol Bonzo Finance suffers oracle attack

Bonzo Lend, the largest lending protocol in the Hedera ecosystem, announced that it suffered losses of approximately $9.05 million due to the exploitation of a vulnerability in a third-party price oracle. Following the attack, Bonzo Lend and Bonzo Points services were temporarily suspended.

According to the incident report published by Bonzo Finance Labs in coordination with the Bonzo Finance Foundation, the attack occurred on July 11, 2026, at approximately 00:51 UTC (03:51 UTC+3). The attacker managed to borrow significantly more than the actual value of SAUCE with a low amount of collateral by sending a manipulated SAUCE price to the Supra oracle system used by Bonzo Lend.

Bonzo argued that the security vulnerability did not stem from its own smart contracts or the design of its lending protocol. The company stated that the problem lay in the signature verification mechanism of the third-party on-chain price oracle used by Bonzo Lend.

According to the report, the first account used by the attacker sent a manipulated SAUCE price in HBAR to the oracle's on-demand price update contract on the Hedera mainnet. While the actual market price of SAUCE is approximately 0.2 HBAR, the value sent by the attacker was shown as approximately 12 decimal places higher than the actual price.

Just eight seconds after the manipulated price was recorded on-chain, the attacker used a small amount of SAUCE investment as collateral. Due to the oracle data, the protocol calculated the value of this collateral to be exceptionally high, resulting in the attacker borrowing assets far exceeding the actual value of their deposited collateral.

According to Bonzo's investigation, the manipulated price update was accepted because Supra's on-chain validator confirmed the proof without a valid signature. The team added that the attacker did not forge a valid oracle signature and that there was no change in SAUCE's actual market price.

The protocol stated that the incorrect price should have been rejected in the oracle's validation layer before reaching Bonzo Lend, but the validation system failed to do so.

It was revealed that a second account also borrowed additional assets from the protocol while the anomalous price data was active. Bonzo stated that this account later contacted the team, identifying itself as a white-hat security researcher and expressing its intention to return the funds. This transaction is being considered by the protocol as part of the recovery process.

It was reported that only the Bonzo Lend and Bonzo Points services were affected by the attack. Bonzo Vaults, Bonzo Bridge, and one-way staking and unstaking services for BONZO and XBONZO continued to operate normally. A graph showing the drop in the price of BONZO.

The lending pool at Bonzo Lend has been suspended while reviews and recovery efforts continue. Bonzo Finance Labs and Bonzo Finance Foundation announced that they are evaluating the conditions under which the protocol could be reopened and the process for liquidity providers to withdraw their assets. The team stated that details regarding compensation for users, recovery of funds, and reactivation of the protocol will be shared later in a separate announcement.

*This is not investment advice.

Hackers Are Manipulating the Price of an Altcoin

基于Hedera的借贷协议Bonzo Finance遭遇预言机攻击，损失约900万美元。攻击者利用SAUCE代币价格被异常抬高后的抵押品，从协议中借出了远超实际价值的资产。

Bonzo发布的初步事故报告显示，攻击者仅存入250枚SAUCE（价值仅数美元），随后提交了一次价格更新，将该代币价格人为抬高约12个数量级。随后，该地址从借贷池中借出了663万美元USDC和3450万枚封装HBAR（wHBAR）。

据悉，此次事件源于预言机服务商Supra链上预言机验证器存在漏洞，其错误接受了一个签名被置零的SAUCE价格数据。

[PANews]

Bonzo遭预言机攻击损失约900万美元，攻击者操纵SAUCE价格借出巨额资产

基於Hedera的借貸協議Bonzo Finance遭遇預言機攻擊，損失約900萬美元。攻擊者利用SAUCE代幣價格被異常抬高後的抵押品，從協議中借出了遠超實際價值的資產。

Bonzo釋出的初步事故報告顯示，攻擊者僅存入250枚SAUCE（價值僅數美元），隨後提交了一次價格更新，將該代幣價格人為抬高約12個數量級。隨後，該地址從借貸池中借出了663萬美元USDC和3450萬枚封裝HBAR（wHBAR）。

據悉，此次事件源於預言機服務商Supra鏈上預言機驗證器存在漏洞，其錯誤接受了一個簽名被置零的SAUCE價格資料。

[PANews]