Bonzo Lend paused after $9 million oracle exploit
An attacker manipulated SAUCE token pricing through a vulnerability in Supra's oracle verifier to drain funds from the Aave v2-based lending protocol
Bonzo Finance Labs, the team behind Bonzo Finance, Hedera’s flagship DeFi lending and borrowing protocol, announced today that Bonzo Lend was exploited on July 11 after an attacker manipulated a third-party oracle price feed, allowing the protocol to vastly overvalue a small SAUCE deposit and enable excessive borrowing.
The team stressed that the issue originated in Supra’s oracle verification process rather than Bonzo Lend’s smart contracts, which it said functioned as designed by using the incorrect on-chain price supplied by the oracle.
The @bonzo_finance lend protocol has been temporarily paused.
The Bonzo Finance Labs team is investigating volatile markets across Bonzo Lend and diligently working alongside partners during this investigation.
The team will continue to provide updates as they become…
— Bonzo Finance Labs (@bonzo_finance) July 11, 2026
Bonzo Lend and Bonzo Points have been paused, while Bonzo Vaults, Bonzo Bridge, and BONZO/XBONZO staking remain unaffected, according to the project.
According to the preliminary incident report, Wallet A submitted a forged price update that inflated SAUCE’s value by roughly 12 orders of magnitude above its actual market price. Bonzo said the manipulated update was accepted because a flaw in Supra’s verifier incorrectly treated a zeroed BLS signature as valid, allowing the false price to be written on-chain.
Once the manipulated price was live, the attacker deposited 250 SAUCE as collateral and borrowed millions of dollars worth of assets. Bonzo said its lending contracts simply read the oracle’s on-chain price and calculated borrowing limits as designed, adding that Supra has since acknowledged the vulnerability and deployed a fix for the affected verifier.
The report further stated that the exploit did not involve vulnerabilities in Bonzo Lend, abnormal market activity, or flash loans, noting SAUCE’s real trading price remained stable throughout the incident.
The report also highlighted the involvement of Wallet B, which borrowed roughly another $1 million while the inflated price remained active before identifying itself as a white-hat participant and offering to return the funds.
Bonzo said it is coordinating the recovery with Wallet B separately and will provide further updates on reimbursements, withdrawals, and remediation once investigations are complete.