The Hedera-based lending protocol Bonzo Lend suffered a loss of approximately $9.05 million after an attacker manipulated the oracle price of the SAUCE token, which was used as collateral. The exploit occurred on July 11, 2026, and prompted the protocol to halt all operations to contain the damage.
According to a preliminary incident report from Bonzo, the attacker deposited just 250 SAUCE—worth only a few dollars—and then submitted a price update that inflated the token's value by roughly 12 orders of magnitude. With the falsified price, the attacker borrowed 6.63 million USDC and 34.5 million wrapped HBAR from the lending pool.
The root cause was a flaw in the on‑chain oracle verifier provided by Supra, Bonzo's oracle partner. The manipulated price carried a zeroed signature that the verifier accepted as valid. Bonzo stated that the vulnerability existed in Supra's system and was not a result of flaws in Bonzo's own smart contracts or in the Hedera core network. Supra acknowledged the issue and deployed a fix shortly after the incident.
The protocol paused all activity immediately upon detecting the breach. Bonzo Labs and the Bonzo Finance Foundation are now working with security teams to assess the full scope and to develop recovery and compensation plans for affected users. Withdrawals remain temporarily unavailable.
The exploit highlights a recurring weakness in decentralized finance: lending markets depend critically on accurate oracles. A single faulty price feed can override loan-to-value limits, liquidation rules, and collateral caps, allowing an attacker to drain substantial liquidity. The incident echoes a similar attack on Stellar's YieldBlox earlier in 2026, where $10 million was lost through price-path manipulation.
Bonzo Lend was the largest lending protocol on Hedera, and the loss deepens concerns around oracle security, especially on smaller networks. It also adds to a broader wave of DeFi exploits in 2026—the second quarter alone saw 83 incidents and $755 million stolen, with a notable decline in total value locked across the sector.
