Bonzo Lend Loses $9M on Hedera in Supra Oracle Exploit

Bonzo Lend, a lending protocol on the Hedera network, lost approximately $9.05 million after an attacker exploited a verification flaw in a third-party Supra oracle contract on July 11.

The attacker deposited 250 SAUCE tokens worth a few dollars as collateral, then submitted a manipulated price update that inflated the token's HBAR-denominated value, according to a preliminary incident report Bonzo published. The account subsequently borrowed 6.63 million USDC and 34.52 million wrapped HBAR, worth roughly $9.05 million at the report's reference HBAR price.

Fake Price, Fast Exit

A second wallet borrowed roughly $1 million more while the abnormal price persisted, then contacted Bonzo through Discord, identified itself as a white-hat responder and said it would return the funds. That put total abnormal borrowing at about $10.06 million before the return.

Bonzo's own X account said the lend protocol had been temporarily paused while its team investigated volatile markets, and later confirmed it remains paused pending recovery work. Supra Labs, whose oracle contract processed the bad price, published its own incident report attributing the failure to a degenerate BLS signature and zero-valued public key that its Hedera verifier wrongly accepted for a single SAUCE/wHBAR feed, while saying its core aggregation and other feeds were unaffected.

Ecosystem Fallout

Hedera's total value locked fell nearly 40% in 24 hours after the exploit, and Bonzo's own TVL plunged 77% in the same window. DefiLlama now shows Bonzo's TVL at $3.06 million.

A security researcher's technical writeup said more than $5.25 million of the stolen funds was bridged to Ethereum via LayerZero and swapped into ETH within hours.