Hedera

LayerZero

Echo Protocol

Tornado Cash

Oracle

Hedera-based lending protocol Bonzo Lend lost approximately $9.05 million after an attacker manipulated the price of SAUCE inside a third-party oracle contract and borrowed assets far beyond the value of the collateral posted.
The attacker deposited 250 SAUCE, worth only a few dollars, before submitting a <a href="https://bonzo.finance/blog/bonzo-lend-incident-report-oracle-provider-exploit" rel="noopener noreferrer nofollow">manipulated price update</a> at approximately 00:51 UTC on July 11. The submitted value inflated SAUCE’s price by roughly 12 orders of magnitude from its market level near 0.2 HBAR.
Eight seconds later, the attacker borrowed 6.63 million USDC and 34.52 million wrapped HBAR from Bonzo Lend. The protocol calculated the loans against the corrupted SAUCE price stored by the oracle.
The exploit targeted the verification path used by Supra’s onchain price infrastructure. A zeroed BLS signature passed the verifier after both the submitted signature point and referenced public key resolved to zero, allowing the false price to be written onchain without a valid oracle committee signature.
Supra has deployed a fix to the affected verifier contract. Bonzo Lend found no <a href="https://cryptoadventure.com/community/articles/what-is-a-crypto-flash-loan/" rel="noopener noreferrer nofollow">flash loan</a>, market-price manipulation or failure inside its lending contracts.
<h2 id="stolen-funds-cross-into-ethereum-through-layerzero">Stolen Funds Cross Into Ethereum Through LayerZero</h2>
Onchain investigator Specter initially traced <a href="https://x.com/SpecterAnalyst/status/2075852579343303121" rel="noopener noreferrer nofollow">more than $3.7 million</a> from Hedera into Ethereum through LayerZero. The attacker began swapping bridged WBTC into ETH after the cross-chain transfers.
PeckShield later placed the bridged amount near $5.25 million. The Ethereum wallet held approximately 2,360 ETH, valued near $4.25 million at the time, and 15.58 WBTC worth around $1 million. The address had originally received 1 ETH from <a href="https://cryptoadventure.com/tornado-cash-explained/" rel="noopener noreferrer nofollow">Tornado Cash</a> before the Hedera transactions began.
The LayerZero route follows April’s $292 million KelpDAO exploit, which prompted BitGo and BiT Global Trust to <a href="https://cryptoadventure.com/bitgo-polygon-among-industry-giants-pushing-rate-limits-after-the-largest-defi-exploit-of-2026/" rel="noopener noreferrer nofollow">suspend WBTC verifier infrastructure</a> connected to LayerZero as a precaution.
A separate <a href="https://cryptoadventure.com/echo-protocol-bridge-incident-sends-384-eth-to-tornado-cash-after-ebtc-mint-on-monad/" rel="noopener noreferrer nofollow">Echo Protocol bridge incident</a> in May also involved borrowed WBTC crossing into Ethereum before being converted into ETH.
<h2 id="bonzo-lend-pauses-pool-and-withdrawals">Bonzo Lend Pauses Pool And Withdrawals</h2>
The $9.05 million estimate covers principal extracted by the primary attacker and excludes roughly $1 million borrowed by a second wallet while the abnormal SAUCE price remained active.
The second wallet contacted Bonzo Finance, identified itself as a white-hat responder and committed to returning the borrowed assets. The amount remains classified as recoverable until the funds and related transaction costs are reconciled.
A legitimate oracle update restored SAUCE to approximately 0.1964 HBAR at 01:36 UTC. Bonzo Lend was paused five minutes later, followed by Bonzo Points at 05:50 UTC.
Bonzo Lend will remain paused while the team develops a withdrawal and recovery plan for liquidity providers. Bonzo Vaults, Bonzo Bridge and single-sided BONZO and XBONZO staking remain operational.
The post <a href="https://cryptoadventure.com/bonzo-lend-loses-9-05m-in-hedera-oracle-exploit/" rel="noopener noreferrer nofollow">Bonzo Lend Loses $9.05M In Hedera Oracle Exploit</a> appeared first on <a href="https://cryptoadventure.com" rel="noopener noreferrer nofollow">Crypto Adventure</a>.

Bonzo Lend Loses $9.05M In Hedera Oracle Exploit

Table of Contents

Crypto Adventure

Other articles published on Jul 11, 2026

Join our free newsletter for daily crypto updates!