Why did Bonzo Lend lose US$9 million?

Bonzo Lend lost about US$9.05 million after an attacker used a false SAUCE oracle price to borrow assets. The manipulated price came from a flaw in Supra's oracle verification system.

How did the Bonzo Lend attack happen?

The attacker exploited a flaw in Supra's verifier, which accepted a zeroed signature as valid. That allowed a false SAUCE price to reach the Hedera network.

How much was stolen from Bonzo Lend?

The main attacker borrowed 6.63 million USDC and more than 34.5 million wrapped HBAR. Bonzo estimated the confirmed loss at about US$9.05 million.

Has the Bonzo Lend vulnerability been fixed?

Yes. Supra said it fixed the affected oracle verifier on the Hedera mainnet. Bonzo also paused lending while recovery work continues.

When will Bonzo Lend reopen?

Bonzo Lend remains paused while Bonzo Finance Labs and the Bonzo Finance Foundation work to recover assets and repair the platform. The team has not announced a reopening date.

Image for illustrative purposes only. Not a real photo.

Bonzo Lend loses US$9M in exploit

Written by Heidi Cuthbert Published Jul 13, 2026, 2:59 AM

Bonzo Lend lost about US$9.05 million after a false oracle price inflated SAUCE token values.
The protocol paused lending after the attacker borrowed millions in USDC and wrapped HBAR.
Supra has fixed the oracle verification flaw while recovery efforts continue.

Bonzo Finance lost about US$9.05 million after an attacker used a false SAUCE price from Supra's oracle to borrow assets from Bonzo Lend.

Bonzo said Supra's verifier accepted a zeroed signature as valid, allowing the false price to reach the Hedera network.

“No valid oracle signature was forged,” Bonzo said.

The attacker borrowed 6.63 million USDC and more than 34.5 million wrapped HBAR, while a second wallet borrowed about US$1 million and later claimed to be a white-hat researcher.

Bonzo paused its lending platform but said its vaults, bridge and single-sided BONZO staking services continued operating.

Supra has fixed the affected verifier contract, while Bonzo said its lending contracts worked as designed because they relied on the manipulated oracle price.

Bonzo Finance Labs and the Bonzo Finance Foundation are working with partners to recover assets and repair the platform, while the lending service will remain paused until further notice.