Exchange Ranking
Top Exchanges
24h Volume Ranking
Popularity Ranking
Exchange BTC Balance
Proof of Reserves
Decentralized Exchanges
Funding Rate
Funding Heatmap
Liquidation Data
Max Pain
Long/Short Ratio
Whale L/S Ratio
Binance/Okex/Huobi L/S
Bitfinex Margin L/S
ETF Tracker
Solana ETF
XRP ETF
Hong Kong ETF
Bitcoin Treasuries
Crypto Reversal
Ethereum Reserves
HyperLiquid Wallet Analysis
Hyperliquid Whale Watch
Large Transactions
On-chain Movement
Bitcoin ROI
Stablecoin Market Cap
Options Analysis
News
Articles
Economic Calendar
Features
Wallet
Contract Calculator
Security
Collections
Watchlist
FollowingHedera confirms details of the Bonzo Lend oracle vulnerability
Hedera said the vulnerability originated from Supra's oracle validator and that the core network and consensus mechanisms were not affected. The attacker lent approximately $9.05 million using the manipulated SAUCE price after the invalid oracle update was accepted. Bonzo Lend remains suspended and recovery work is underway, while other Bonzo services continue to operate normally.
Oracle verification failure triggered a loan incident
On July 11, 2026, a oracle verification vulnerability occurred on the Hedera main network, causing Bonzo Lend to suspend operations. According to Hedera and Bonzo Finance Labs, the incident affected an independently operating DeFi application, while Hedera's consensus mechanism and core network remained operating normally. The investigation found that a third-party oracle validator was the root cause of the failure.
According to Hedera, Bonzo Lend's smart contract worked as designed throughout the incident. Instead, investigators traced the problem to Supra's oracle verification process-which accepted an invalid price update before Bonzo Lend read the data. According to Bonzo Finance Labs, Wallet A submitted a manipulated SAUCE price at approximately 00:51 UTC. This imaginary high is approximately 12 orders of magnitude higher than the market price of the token. Eight seconds later, the same wallet used 250 SAUCEs as collateral, borrowing assets from Bonzo Lend that far exceeded the actual value of the collateral.
The report states that the verifier did not reject the commit, but instead accepted a zero-signature commit. As a result, the manipulated price reaches on-chain storage before it is processed by Bonzo Lend.
Hedera and Supra respond to incident
At the same time, Hedera said that Supra has admitted the oracle verification vulnerability and deployed a fix for the affected validator contract on Hedera's main network. The network added that security experts are continuing to review the attack with relevant teams. Hedera also reiterated that Bonzo Lend's contract was working exactly as expected. According to the network, the failure occurred upstream of the oracle layer rather than within the loan agreement. Bonzo Finance Labs further confirmed that Chainlink and Supra both offer oracle services on Hedera, but that most ecosystem asset prices, including SAUCE, rely on Supra's infrastructure.
Recovery work continues and services remain suspended
According to Bonzo Finance Labs, Wallet A withdrew approximately US$9.05 million in loan principal. The report excludes another approximately $1 million borrowed by Wallet B because the wallet described itself as a white-hat responder. Wallet B contacted the team through Discord and expressed its intention to return the borrowed assets. At the same time, Bonzo Finance Labs confirmed that restoration discussions are still ongoing. Bonzo Lend and Bonzo Points remain on hold and the team is evaluating the conditions for reopening. However, Bonzo Vaults, Bonzo Bridge, and unilateral BONZO and XBONZO pledges continued to operate normally and were unaffected.
