Overview of the Breach
Bonzo Lend, a lending platform based on the Hedera blockchain, faced a significant breach on July 11, 2026, leading to an estimated loss of $9.05 million. The attack exploited a flaw in how the price of the SAUCE token was reported through a third-party oracle, called Supra.
Details of the Attack
An attacker manipulated the pricing mechanism by submitting an inflated SAUCE value to the oracle, which incorrectly assessed the asset’s worth. The incident began when a malicious actor deposited just 250 SAUCE, which had negligible market value, but this was processed as a highly valuable asset by the oracle.
Within seconds of the inflated price being recognized by the network, the attacker successfully borrowed 6.63 million USDC along with over 34.5 million wrapped HBAR. In response to the alarming situation, Bonzo promptly paused its lending operations at 01:41 UTC, with the temporary halt extending to other functionalities later that same morning, though some services like Bonzo Vaults and Bonzo Bridge remained operational.
Investigation Findings
In their investigation, Bonzo Finance Labs identified that the root of the issue lay within Supra’s signature verification system, which erroneously transmitted a zero-value signature instead of a legitimate one. This glitch allowed the system to validate the manipulated price as if it came from a trusted source.
The verifiers failed to discard the invalid inputs, resulting in a false positive within Hedera’s pairing contract—the verification mechanism mistook the identity point calculation as proof of an authentic signature, which in reality, it was not.
Response and Recovery Efforts
Despite the chaos, Bonzo clarified that neither its contracts were vulnerable, nor did the attack involve common strategies such as flash loans or typical market manipulation. Additionally, while another account also borrowed roughly $1 million during the anomaly, it later approached the Bonzo team identifying themselves as a white-hat hacker, intending to return the funds. Bonzo has not included this amount in its total loss due to ongoing discussions surrounding asset recovery.
Meanwhile, reports surfaced from security researchers noting that over $5.8 million had been transferred from the Hedera network to Ethereum, with parts of the assets being converted through LayerZero from wrapped Bitcoin to Ether. This news negatively impacted HBAR, causing its price to drop over 2%.
Following the attack, the legitimate SAUCE price was restored at 01:36 UTC, just moments prior to the suspension of the lending pool.
Current Status
As investigations continue, Bonzo remains locked down, with significant efforts underway to recover lost assets and to implement necessary repairs. The Bonzo team, along with the Bonzo Finance Foundation, is collaborating with partners but has yet to announce when the lending services might resume.
