Bonzo Lend, a leading lending protocol within the Hedera ecosystem, reported a significant loss of roughly $9.05 million following a recent attack that exploited a vulnerability in a third-party price oracle. In response, the platform temporarily suspended its Bonzo Lend and Bonzo Points services.

The incident occurred early on July 11, 2026, at approximately 00:51 UTC. An attacker managed to leverage a manipulated price of the SAUCE token to borrow excessively beyond its actual value. This manipulation involved sending an inflated price to the Supra oracle system utilized by Bonzo Lend.

Bonzo stated that the security flaw was not in its own smart contracts, but originated from the signature verification mechanism of the external price oracle. The attacker instructed the oracle to report a price for SAUCE that was significantly higher than the market value, which is around 0.2 HBAR. The manipulated value reflected a staggering increase of nearly 12 decimal places over the actual price.

Less than ten seconds after this false price was recorded on-chain, the hacker used a minor amount of SAUCE as collateral. This led the protocol to miscalculate the value of the collateral, allowing the attacker to borrow assets far exceeding the amount they had deposited.

Bonzo's investigation revealed that the manipulated price update was accepted because the Supra validator erroneously confirmed the proof without a valid signature. The report clarified that the attacker did not forge any signature, and there was no alteration in SAUCE's actual market price.

Another account also exploited the anomalous price data to borrow additional assets. Subsequently, this account reached out to Bonzo, identifying themselves as a white-hat security researcher, and expressed their intention to return the funds. This development is being viewed as part of the recovery process by the protocol.

It is important to note that only the Bonzo Lend and Bonzo Points services were impacted by this incident. According to the protocol's statement, the erroneous price should have been flagged and rejected during the oracle's validation phase before it reached Bonzo Lend.

This material is for informational purposes only and does not constitute financial advice.