Image Credit: Shutterstock
Bonzo Lend lost about $9.05 million after an attacker exploited a third-party oracle on Hedera and borrowed assets far beyond the value of the collateral posted.
The lending protocol has paused Bonzo Lend and its points program while the team works with the Bonzo Finance Foundation and ecosystem partners on recovery steps.
SAUCE Price Was Inflated by 12 Orders
The incident happened on July 11 at about 00:51 UTC. Bonzo said an attacker submitted a manipulated price update for SAUCE to a third-party oracle contract on Hedera mainnet. The update inflated SAUCE’s HBAR-denominated price by roughly 12 orders of magnitude.
The attacker then deposited 250 SAUCE, worth only a small amount under normal market prices. Because the manipulated feed made the collateral appear far more valuable, the wallet was able to borrow far more from Bonzo Lend than it should have been allowed to take.
Bonzo said the first wallet borrowed 6.63 million USDC and 34.52 million wrapped HBAR. Using the HBAR price referenced in the report, the withdrawals were worth about $9.05 million.
Oracle Verifier Accepted Invalid Proof
Bonzo said the loss did not come from its lending contracts, vaults, bridge or staking products. The issue came from the oracle verification path before the price reached Bonzo Lend. According to the project’s report, the oracle’s on-chain verifier accepted a proof that carried no valid signature.
That meant the attacker did not need to forge a real oracle committee signature or move the actual SAUCE market price. The verifier accepted an update it should have rejected. Bonzo said Vaults, Bridge, and single-sided BONZO and XBONZO staking were not affected and continue to operate normally.
White-Hat Wallet Borrowed Another $1M
A second wallet borrowed additional assets while the abnormal price was still live. Bonzo said that wallet later contacted the team, identified itself as a white-hat responder and said it intended to return the funds.
The second wallet borrowed about $1 million, bringing total principal borrowed during the incident to about $10.06 million before recovery. Bonzo excluded the white-hat amount from its headline loss estimate.
Bonzo TVL Falls 77% After Exploit
The exploit was followed by a sharp fall in Hedera DeFi liquidity. Bonzo’s total value locked fell 77% after the incident, while Hedera’s overall total value locked dropped nearly 40% within 24 hours.
The next step is recovery coordination. Bonzo Lend remains paused, and the team has not yet released a final plan for reimbursement, withdrawals or when the lending market can reopen.
