The DeFi protocol Bonzo Lend, operating on the Hedera blockchain, fell victim to a large-scale attack, resulting in the theft of assets worth approximately $9 million by an attacker. The cause of the incident was the compromise of a third-party price oracle, not a vulnerability in the protocol's own smart contracts.
According to my analysis of the incident data, the attacker deposited only 250 SAUCE tokens as collateral. He then manipulated the data from the Supra oracle, artificially inflating the asset's price by approximately one trillion times. This colossal discrepancy allowed the attacker to borrow about 6.6 million USDC and 34.5 million wHBAR with virtually zero collateral. In effect, the hacker gained access to the protocol's liquidity using fake prices that did not correspond to market reality.
The Bonzo Finance team responded promptly by suspending the lending service and the points accrual program. Developers emphasize that the incident is related to an error in the price verification system of the oracle provider Supra, not defects in the Bonzo Lend code. They are currently collaborating with partners in the Hedera ecosystem to analyze the situation and prepare an asset recovery plan.
Interesting twist: one of the addresses involved in withdrawing about $1 million during the "window" of the anomalous SAUCE price identified itself as a "white hat hacker" and stated its intention to return the funds. This may indicate that part of the losses will be recovered, although full recovery of all $9 million remains in question.
My expert commentary: This incident is yet another reminder of the critical importance of oracle reliability in DeFi. Even if smart contracts are flawless, a vulnerability in the data supply chain can lead to catastrophic consequences. Protocols need to implement multi-layered price verification systems and backup mechanisms to minimize the risks of such manipulations. For Hedera, this is a serious blow to trust in the ecosystem, especially against the backdrop of an overall decline in hack losses in the first half of 2026 (approximately $972 million according to Immunefi).