Exchange Ranking
Top Exchanges
24h Volume Ranking
Popularity Ranking
Exchange BTC Balance
Proof of Reserves
Decentralized Exchanges
Funding Rate
Funding Heatmap
Liquidation Data
Max Pain
Long/Short Ratio
Whale L/S Ratio
Binance/Okex/Huobi L/S
Bitfinex Margin L/S
ETF Tracker
Solana ETF
XRP ETF
Hong Kong ETF
Bitcoin Treasuries
Crypto Reversal
Ethereum Reserves
HyperLiquid Wallet Analysis
Hyperliquid Whale Watch
Large Transactions
On-chain Movement
Bitcoin ROI
Stablecoin Market Cap
Options Analysis
News
Articles
Economic Calendar
Features
Wallet
Contract Calculator
Security
Collections
Watchlist
Following
HBAR Bonzo Lend, a loan agreement based on Hedera, was attacked and lost approximately $9 million. The attackers manipulated the price of SAUCE tokens as collateral, allowing accounts to lend out assets far beyond their deposited value.
Bonzo said in a preliminary incident report released on Saturday that the attacker first deposited 250 SAUCEs (worth just a few dollars) and then submitted a price update that artificially increased the value of the token by about 12 orders of magnitude. The wallet subsequently lent 6.63 million USDC and 34.5 million encapsulated HBAR from the loan pool.
This case shows that even if applications and underlying networks are working properly, oracle failure can turn low-value collateral into a tool to drain substantial liquidity from lending agreements. Bonzo attributed the incident to a flaw in the oracle verifier on the Supra chain that accepted a manipulated SAUCE price with a zeroing signature. The parties to the agreement said Supra had admitted the problem and deployed a fix, while emphasizing that the incident was not a vulnerability in the Bonzo Lend contract or Hedera's core network.
DeFi hacking continues to hit the industry
This incident is the latest in a series of attacks on the decentralized finance (DeFi) protocol in 2026. The second quarter became the quarter with the most hacking incidents on record, with a total of 83 attacks and approximately $755 million in stolen funds. Among them, cross-chain bridge attacks caused $351 million in losses, while theft of administrator rights and fake token price manipulation attacks accounted for 37% of the total losses in the quarter.
In 2026, DeFi's total locked positions (TVL) fell 39% from approximately US$115 billion in January to more than US$70 billion in June. CryptoRank records show that a total of 121 hacking attacks occurred during this period, resulting in losses of approximately US$942 million, and points out that frequent security incidents are likely to weaken user confidence and intensify capital outflows.
Prior to the Bonzo incident, similar collateral price manipulation attacks occurred on the Stellar chain. In February, attackers stole approximately $10 million from a lending pool managed by YieldBlox DAO by manipulating the price path used to value UTRY collateral, allowing them to lend assets far in excess of the actual value of the tokens.
