Bonzo Lend on Hedera Loses $9.05M to Oracle Price Exploit

Bonzo Lend on Hedera lost approximately $9.05 million after an attacker used a faulty third-party oracle verifier to publish a fake price for the SAUCE token and borrow large sums against minimal collateral. The protocol paused its lending product and halted its points program following the exploit.

According to Bonzo’s incident report, the attacker deposited 250 SAUCE-worth only a few dollars-around 8:40 p.m. ET on Friday. The attacker then submitted a manipulated price update to Supra’s on-demand oracle. The forged update overstated SAUCE’s value by about 12 orders of magnitude and went on-chain at 8:51 p.m. ET. Within seconds, one wallet borrowed about 6.63 million USDC and 34.5 million wrapped HBAR against the near-worthless deposit. Using an HBAR reference price of roughly $0.07, Bonzo valued the principal extracted at about $9.05 million.

Bonzo’s report noted the fake update carried a cryptographic signature made entirely of zeros. Supra’s verifier should have rejected that signature, but a flaw in the verifier’s signature checks allowed the bogus update to be treated as valid. Bonzo added the attack did not involve breaking Supra’s cryptography or stealing a signing key; the exploiter used the verifier’s validation weakness to submit an unauthorized price. Supra acknowledged the issue and deployed a fix to the affected verifier contract on Hedera mainnet.

“It is because of that fix, and the resulting ability to inspect the contract's behavior, that we are able to describe the mechanism,” Bonzo wrote.

A second wallet borrowed roughly $1 million while the manipulated price was live and later contacted Bonzo, identifying itself as a white-hat responder and indicating an intention to return the funds. Bonzo excluded that amount from its headline loss figure; without that exclusion the total would have been about $10.06 million. On-chain investigator activity flagged suspicious fund movements from Hedera to Ethereum before Bonzo confirmed the exploit source.

A legitimate oracle update restored SAUCE’s price at 9:36 p.m. ET and Bonzo paused its lending pool five minutes later. Bonzo said its vaults, bridge and staking products were not affected. Teams from Bonzo, Supra and Hedera began tracing fund flows and coordinating remediation after the verifier patch. Hedera posted that the incident was confined to a third-party oracle verifier and did not affect the network’s core infrastructure.

Industry data show that projects lost roughly $972 million across 207 incidents in the first half of 2026, with several recent losses tied to failures in peripheral infrastructure such as oracle verifiers and bridge verification. Bonzo and Supra continue to monitor on-chain movements and work on recovery and mitigation steps as investigations proceed.