Hedera Lending Protocol Bonzo Finance Suffers $9 Million Loss from Oracle Attack
Bonzo Finance encountered an oracle attack, where the attacker exploited the SAUCE token price being abnormally inflated to borrow assets far exceeding their value, resulting in a loss of approximately $9 million.
The attacker deposited 250 SAUCE worth a few dollars, then submitted a price update that inflated the token price by about 12 orders of magnitude, subsequently borrowing $6.63 million USDC and 34.5 million wHBAR.
The attack stemmed from a vulnerability in the Supra oracle validator that accepted zeroed price data signatures, which has since been fixed; Bonzo emphasized that there was no vulnerability in its own contracts or the Hedera network.
Source: Public Information
ABAB AI Insight
As a lending protocol in the Hedera ecosystem, Bonzo Finance previously relied on external oracles like Supra for price data. This incident continues to highlight the common vulnerabilities in the price oracle aspect of DeFi projects, similar to multiple cross-chain and lending protocols that have suffered losses due to oracle manipulation.
In terms of capital pathways, the attacker manipulated the collateral price at a very low cost to extract significant liquidity from the protocol, exposing the financial risks of DeFi projects that depend on third-party oracles. Supra's rapid fix reflects an optimization of the security response mechanism, but it could not prevent the losses that had already occurred.
Similar to the approximately $10 million loss suffered by YieldBlox in the Stellar ecosystem due to collateral price manipulation in February this year, there have been 83 attack incidents reported in Q2 2026, with cross-chain bridges and price manipulation being the main sources of loss, indicating that the industry's security offense and defense are still in a high-intensity confrontation phase.
Essentially, this relates to regulatory changes and the restructuring of the industry chain: ongoing security incidents have accelerated the decline of DeFi Total Value Locked (TVL) from $115 billion in January to over $70 billion in June (a drop of 39%), driven by a loss of user confidence that pushes funds towards centralized or more strictly audited platforms, while also forcing projects to strengthen the decentralization of oracles and multi-source verification.
ABAB News · Law of Cognition
The cost of oracle vulnerabilities is the lowest, yet their destructive power is the highest; the weakest link in the trust chain determines life and death.
The 39% drop in TVL is not a result of a bear market, but a necessary punishment for the accumulation of security incidents.
Attackers will always pursue the path of lowest cost and highest return; protocols must first block this route.