Key Takeaways
Bonzo Lend, the largest lending protocol on the Hedera network, lost about $9.05 million on July 11 after an attacker fed a rigged price into a third-party Supra oracle, not through any flaw in Bonzo's own code.
The attacker deposited a near-worthless token, inflated its value by roughly twelve orders of magnitude, borrowed far past the collateral, and bridged about $5.25 million to Ethereum before the protocol paused.
Hedera's total value locked fell close to 40 percent within a day and Bonzo's dropped 77 percent, the third DeFi security failure flagged in about a week.
On July 11, Bonzo Lend, the biggest decentralized lending protocol on the Hedera network, was drained of roughly $9.05 million. As CoinDesk reported, the attacker did not break Bonzo's own code. They exploited a verification flaw in a Supra price oracle, the third-party service Bonzo relied on to price the assets people deposited.
The rest was simple once the oracle could be fooled. The attacker deposited a small amount of SAUCE, a low-value Hedera token that normally trades around 0.2 HBAR, then pushed a manipulated price update that inflated its value by about twelve orders of magnitude. With collateral that suddenly looked enormous, they borrowed real assets far beyond what they had put in and left. The Block reported that the Supra verifier accepted the doctored price without catching it, and Supra has since deployed a fix to the affected contract.
About $5.25 million was bridged from Hedera to Ethereum before Bonzo paused the protocol, and the damage did not stay contained to one app. Hedera's total value locked fell close to 40 percent in a day and Bonzo's own locked value dropped 77 percent, according to crypto.news. It was the third DeFi failure flagged in roughly a week, after a $6 million flash-loan exploit at Summer Finance and the $20 million governance attack that hit BONK DAO. Each one used a different door in.
The through line is that most of these losses trace back to how a price gets set on-chain, not to the lending logic itself. That was the story when an attacker inflated a tokenized Google stock to drain Edel Finance, where the oracle held and the wrapper did not, and it is the story again here, with the oracle itself as the weak point. As tokenized assets and on-chain lending scale up, the price layer keeps deciding who wins. Worth watching.
People Also Ask
What is Bonzo Lend?
Bonzo Lend is the largest decentralized lending protocol on the Hedera network, where users deposit crypto as collateral and borrow other assets against it.
How was Bonzo Lend exploited?
An attacker exploited a verification flaw in a third-party Supra price oracle, inflating a low-value token's reported price and then borrowing far more than the collateral was actually worth.
How much did Bonzo Lend lose?
About $9.05 million, with roughly $5.25 million bridged from Hedera to Ethereum before the protocol was paused.
Was Hedera or Bonzo Lend's code at fault?
No. The flaw was in a third-party Supra oracle contract, which has since been fixed. Even so, Hedera's total value locked fell about 40 percent in a day.