The DeFi protocol Bonzo Lend, operating within the Hedera ecosystem, fell victim to a sophisticated attack, resulting in losses of approximately $9 million. The attacker exploited a vulnerability in a third-party price oracle, allowing them to manipulate market data and drain liquidity.
According to the analysis conducted, the attacker deposited only 250 SAUCE tokens as collateral. They then fed a fake price for the asset into the oracle, inflating it by roughly a trillion times. This crude manipulation allowed the attacker to borrow approximately 6.6 million USDC and 34.5 million wHBAR with virtually no collateral. This is a classic example of an oracle attack, where trust in an external data source becomes a point of failure.
The Bonzo Finance team promptly suspended the lending service and the points accrual program. Developers emphasize that the incident is related to an error in the price verification system of the oracle provider Supra, not to vulnerabilities in the protocol's smart contracts. This is an important nuance, pointing to the need for more thorough vetting of third-party integrations.
Currently, collaboration is underway with partners in the Hedera ecosystem to analyze the incident and prepare an asset recovery plan. Interestingly, one of the addresses involved in withdrawing about $1 million during the window of the anomalous SAUCE price identified itself as a "white hat hacker" and expressed an intention to return the funds. This could mitigate the consequences but does not eliminate systemic risks.
According to Immunefi, in the first half of 2026, crypto projects lost approximately $972 million across 207 incidents. The attack on Bonzo Lend is another reminder that even with a robust smart contract architecture, dependence on external oracles remains a critical threat vector.
My expert conclusion: This case underscores the need to use decentralized and multi-layered oracle systems, as well as to implement mechanisms to protect against price manipulation, such as delays in data updates or loan limits. Without this, such attacks will continue, undermining trust in DeFi.