Hedera-based DeFi 'Bonzo Lend' Loses $9 Million Due to Oracle Vulnerability

Bonzo Lend Suffers $9 Million Loss from Oracle Vulnerability

On July 11, a security breach occurred in the lending protocol "Bonzo Lend (Bonzo Finance)" operating on the Hedera (Hedera/HBAR) network, exploiting a flaw in the price reference system, resulting in damages of approximately $9 million (around 1.35 billion yen).

It appears that hacking involving the Hedera network is ongoing, with over $3.7 million already bridged to Ethereum by the attackers. The stolen funds are currently being exchanged from WBTC to ETH after being bridged from the Hedera network via Layerzero.

For safety reasons, the protocol and point program have been temporarily suspended. The incident began when on-chain researcher Specter tracked suspicious fund movements flowing to Ethereum (Ethereum/ETH). The investigation revealed that the attackers deposited a mere 250 SAUCE tokens (worth a few dollars) as collateral and exploited a bug in the system, causing its valuation to skyrocket by about 12 digits. Based on this fictitious asset value, they fraudulently borrowed 6.63 million USDC and 34.5 million Wrapped HBAR (WHBAR) from the pool.

Additionally, another wallet that withdrew about $1 million (around 160 million yen) during the same period claimed to be a white hat (ethical hacker) and expressed intentions to return the funds.

The Cause: Defect in Price Oracle, Not Smart Contracts

Regarding this incident, Bonzo stated that there were no issues with their smart contracts or the core Hedera network, but rather the cause lies with the external price supply system— the oracle.

Specifically, there was a serious defect in the on-chain oracle verifier of the data provider Supra. This verifier accepted tampered SAUCE price data with zero signatures, invalidating existing legitimate signatures. As a result, the manipulated abnormal high price was directly reflected in the protocol. Supra has already acknowledged the issue and applied a fix.

Increasingly Sophisticated Price Manipulation and Ongoing Trials in the 2026 DeFi Market

As seen in this case, even if the network or application itself is functioning normally, methods that exploit distortions in price data to siphon off liquidity have occurred in the past.

In February of this year (2026), the Stellar-based "YieldBlox DAO" lost approximately $10 million (around 1.6 billion yen) due to similar price route manipulation.

Moreover, in 2026, cybercrime targeting cryptocurrency platforms has been on the rise. In July alone, attacks on "Summer.fi" amounting to $6 million (around 970 million yen) and a governance attack on "BONK DAO" for $20 million (around 3.23 billion yen) have contributed to a total damage exceeding $28 million (around 4.5 billion yen). According to data companies, the second quarter of 2026 recorded the highest number of incidents at 83 (with damages around 122.28 billion yen). The theft of administrative privileges and price manipulation accounted for 37% of the total incidents.

These successive security breaches have led to user distrust, with the total value locked (TVL) in DeFi (decentralized finance) assets, which was approximately $115 billion (around 18.6 trillion yen) at the beginning of the year, decreasing by about 39% to just over $70 billion (around 11.3 trillion yen) by June, putting the entire industry in a challenging position.