Hedera

DeFi

April

USDC

YieldBlox

Hedera-based lending protocol Bonzo Lend lost about $9 million after an attacker manipulated the price of the SAUCE token used as collateral, allowing the account to borrow assets far beyond the value deposited.
In a preliminary incident report published Saturday, Bonzo <a href="https://bonzo.finance/blog/bonzo-lend-incident-report-oracle-provider-exploit" rel="noopener noreferrer nofollow">said</a> the attacker deposited 250 SAUCE, worth only a few dollars, before submitting a price update that inflated the token’s value by roughly 12 orders of magnitude. The wallet then borrowed 6.63 million USDC and 34.5 million wrapped HBAR from the lending pool.
The case illustrates how oracle failures can turn low-value collateral into a tool for draining large amounts of liquidity from lending protocols, even when the application and underlying network continue operating as designed.&nbsp;
Bonzo attributed the incident to a flaw in Supra’s onchain oracle verifier, which accepted a manipulated SAUCE price carrying a zeroed signature, that is, a digital signature that has no content or is empty, effectively deleting any existing signature.
The protocol said Supra acknowledged the issue and deployed a fix, while stressing that the incident was not a vulnerability in Bonzo Lend’s contracts or Hedera’s core network.
<img alt="" height="567" src="https://s3-images.ctmedia.io/media/content/pasted-image-554.jpeg" width="1301">
Estimated economic impact of the incident. Source: Bonzo Finance
<h2 id="defi-hacks-continue-to-pressure-the-sector">DeFi hacks continue to pressure the sector&nbsp;</h2>
The incident adds to a growing number of exploits targeting decentralized finance (DeFi) protocols in 2026.&nbsp;
The second quarter had <a href="https://cointelegraph.com/news/q2-2026-most-hacked-quarter-record-83-incidents" rel="noopener noreferrer nofollow">become the most-hacked quarter</a> on record by incident count, with 83 exploits and about $755 million stolen. Cross-chain bridge exploits accounted for $351 million, while compromised administrator attacks and fake token price manipulation represented 37% of quarterly losses.&nbsp;
In 2026, DeFi’s total value locked (TVL) <a href="https://cointelegraph.com/news/defi-tvl-falls-39-2026-erases-45b-value" rel="noopener noreferrer nofollow">had fallen 39% to over $70 billion in June</a> from about $115 billion in January. CryptoRank recorded 121 hacks and roughly $942 million in losses over the period, saying repeated security incidents likely weighed on user confidence and reinforced capital outflows.
Related: <a href="https://cointelegraph.com/news/all-defi-unsafe-ai-security-debate" rel="noopener noreferrer nofollow">‘All DeFi unsafe’ claim sparks AI security debate after April hack surge</a>
The Bonzo incident also follows a similar collateral-pricing exploit on Stellar. In February, attackers <a href="https://cointelegraph.com/news/redstone-launches-stellar-price-oracles-defi-infrastructure" rel="noopener noreferrer nofollow">drained roughly $10 million</a> from a YieldBlox DAO-managed lending pool after manipulating the price path used to value USTRY collateral, allowing them to borrow assets beyond the token’s real worth.&nbsp;
Magazine: <a href="https://cointelegraph.com/features/how-crypto-built-political-influence-in-washington" rel="noopener noreferrer nofollow">Will the crypto lobby's $189M campaign get CLARITY over the line?</a>

Bonzo Lend loses $9M in oracle exploit on Hedera

Table of Contents

Cointelegraph

Other articles published on Jul 11, 2026

Join our free newsletter for daily crypto updates!