As a lending protocol in the Hedera ecosystem, Bonzo Finance previously relied on external oracles like Supra for price data. This incident continues to highlight the common vulnerabilities in the price oracle aspect of DeFi projects, similar to multiple cross-chain and lending protocols that have suffered losses due to oracle manipulation.

In terms of capital pathways, the attacker manipulated the collateral price at a very low cost to extract significant liquidity from the protocol, exposing the financial risks of DeFi projects that depend on third-party oracles. Supra's rapid fix reflects an optimization of the security response mechanism, but it could not prevent the losses that had already occurred.

Similar to the approximately $10 million loss suffered by YieldBlox in the Stellar ecosystem due to collateral price manipulation in February this year, there have been 83 attack incidents reported in Q2 2026, with cross-chain bridges and price manipulation being the main sources of loss, indicating that the industry's security offense and defense are still in a high-intensity confrontation phase.

Essentially, this relates to regulatory changes and the restructuring of the industry chain: ongoing security incidents have accelerated the decline of DeFi Total Value Locked (TVL) from $115 billion in January to over $70 billion in June (a drop of 39%), driven by a loss of user confidence that pushes funds towards centralized or more strictly audited platforms, while also forcing projects to strengthen the decentralization of oracles and multi-source verification.

ABAB News · Law of Cognition

The cost of oracle vulnerabilities is the lowest, yet their destructive power is the highest; the weakest link in the trust chain determines life and death.
The 39% drop in TVL is not a result of a bear market, but a necessary punishment for the accumulation of security incidents.
Attackers will always pursue the path of lowest cost and highest return; protocols must first block this route.