Bonzo Lend Loses $9 Million After Hedera Oracle Exploit

The attack exploited a flaw in a Supra oracle contract and sent Hedera’s TVL sharply lower. Bonzo says the damage currently stands at $9.05 million, with additional loans taken out through a second Wallet.

Key Takeaways

• Bonzo Lend lost an estimated $9.05 million after an attacker exploited a verification flaw in a third-party Supra oracle contract on Hedera.
• The attacker manipulated the price feed, deposited 250 SAUCE tokens, and then borrowed 6.63 million USDC and 34.52 million wrapped HBAR.
• The total value locked on Hedera fell to $25.7 million, nearly 40% lower than 24 hours earlier.

Bonzo Lend, a decentralized lending protocol on Hedera, says it lost an estimated $9.05 million (€7.9 million) after an attacker took advantage of a verification flaw in a third-party Supra oracle contract. By tampering with the price feed, the attacker was able to borrow far more than the collateral should have supported, a familiar weak point for DeFi protocols that depend on external oracles.

How the Attack Worked

In a preliminary incident report, the protocol said the attacker first deposited 250 SAUCE tokens, which had little value. A manipulated price update then artificially increased the HBAR value of those tokens. Using that inflated price, the account borrowed 6.63 million USDC and 34.52 million wrapped HBAR. At the HBAR price of $0,06998 (€0,061) used in Bonzo’s report, the total came to about $9.05 million (€7.9 million).

Bonzo also said a second wallet borrowed another roughly $1 million (€0.9 million) in assets while the bad price feed was still live. That wallet later contacted Bonzo on Discord, said it was acting as a white-hat responder, and said it intended to return the funds. Bonzo excluded those assets from its headline loss estimate, bringing the total principal borrowed during the incident to about $10.06 million (€8.8 million) before any recovery.

Pressure on Hedera TVL

The fallout extended beyond Bonzo. According to DeFiLlama, Hedera’s total value locked has fallen to $25.7 million (€22.5 million), nearly 40% lower than it was 24 hours earlier. For a network where liquidity and confidence in lending markets are closely linked, the decline shows how fast an oracle exploit can ripple through broader DeFi activity. It also adds to a growing list of incidents on the network, including an earlier exploit on Hedera where losses had already climbed above $5 million (€4.4 million).

Oracle Risk Still Matters

The incident is another reminder that DeFi remains exposed when third-party price feeds become the weakest part of the system. Past cases, including the $117 (€102) million exploit of Mango Markets in 2022, already showed that oracle manipulation can do serious damage without a protocol being directly hacked. For European crypto readers, the takeaway is simple: security is not just about wallets or smart contracts, but also about the infrastructure that pushes prices into lending markets.