Hedera-Based Bonzo Lend Loses $9 Million in Oracle Exploit

On July 11, 2026, Bonzo Lend, a lending protocol operating on the Hedera mainnet, experienced an oracle exploit that led to an estimated loss of $9 million. The event commenced at 00:51 UTC when Wallet A provided a falsified price update for the SAUCE/wHBAR trading pair to a third-party oracle system. This inflated price enabled Wallet A to use a minimal amount of SAUCE as collateral while borrowing assets far exceeding its actual worth. A vulnerability in the oracle's signature verification allowed a zeroed signature to be accepted, as the BLS pairing check returned true with both the signature point and public key set to zero. Bonzo Lend's core contracts operated correctly, resulting in Wallet A borrowing 6,634,528.202695 USDC and 34,518,389.36109841 wHBAR against 250 SAUCE. The protocol was paused at 01:41 UTC, followed by a halt of Bonzo Points at 05:50 UTC. A second wallet, Wallet B, also borrowed additional funds, increasing potential losses to $10.06 million; however, Wallet B reached out to the team as a white-hat hacker and pledged to return the assets. Hedera confirmed that the mainnet remained secure, while Supra recognized the incident and implemented a fix. Bonzo is collaborating with the Bonzo Finance Foundation to recover funds and assess the conditions necessary for a safe protocol reopening.