GoCheckMyCrypto.comBonzo Loses 77% of TVL in $9 Million Oracle Exploit on Hedera
Hedera lending protocol Bonzo lost roughly 77% of its value locked after a $9 million oracle exploit. Reporting indicates the attacker exploited a third-party Supra oracle that accepted a manipulated price update.
A lending protocol on Hedera lost roughly $9.05 million after an attacker fed it one bad price. According to CoinDesk, Bonzo Lend saw its total value locked plunge 77% in the 24 hours following the exploit, and the damage spread past the protocol itself: Hedera's chain-wide TVL fell nearly 40% over the same period, to $25.7 million, per CoinDesk citing DeFiLlama data.
This is a case study in how DeFi lending's reliance on external price feeds concentrates risk. The breach did not originate in Bonzo's own code. It came through a verification flaw in a third-party Supra oracle contract, meaning the attack surface was a dependency Bonzo relied on rather than its own logic.
The mechanics, drawn from Bonzo's preliminary incident report as cited by CoinDesk, are straightforward. The attacker deposited 250 SAUCE tokens of little value, then submitted a manipulated price update that inflated those tokens' HBAR-denominated value. That let the attacker borrow far beyond what the collateral was actually worth. An oracle, in this context, is the external service that tells a protocol what an asset is worth; when the oracle accepted the false price, Bonzo's lending logic treated worthless collateral as valuable.
The borrowing that followed was large. Per Bonzo's incident report, the attacker's account borrowed 6.63 million USDC and 34.52 million wrapped HBAR. At the report's reference HBAR price of $0.06998, those two withdrawals were worth approximately $9.05 million, the headline loss figure.
There was a second actor. While the abnormal price remained active, a separate wallet borrowed roughly $1 million in additional assets, then contacted Bonzo through Discord, identified itself as a white-hat responder, and said it intended to return the funds. Bonzo excluded that wallet's assets from its headline loss estimate, which places the total principal borrowed during the incident at approximately $10.06 million before any recovery, higher than the $9.05 million headline number.
Several caveats sit on top of the reporting. The loss figures come from Bonzo's own preliminary incident report and have not been independently verified in the source text. The self-identified white-hat wallet's roughly $1 million has not been confirmed as returned; only an intention to return the funds was stated. And because the flaw lived in a third-party Supra oracle, other protocols relying on the same feed could share the exposure.
Several things remain unanswered in the sources: the identity of the attacker and whether any principal has been traced or recovered, whether Supra has acknowledged the verification flaw or shipped a fix, and whether Bonzo plans to compensate affected users. The sources describe how the manipulated price passed the verifier only at a high level.
The exploit drained about $9 million and cut Bonzo's total value locked by roughly 77%.
Watch two things: whether the self-identified white-hat actually returns the roughly $1 million it borrowed, and whether Supra acknowledges and patches the verifier flaw, since any protocol on the same feed could carry the same exposure. Independent confirmation of the loss totals, which currently rest on Bonzo's own preliminary report, would firm up the picture. Signs that Hedera's TVL is stabilizing, or continuing to bleed, will show whether this was a contained incident or a broader confidence shock.
And that's the way it is.
Sources
Not financial advice. Crypto Cronkite reports events and explains what they may mean. It never tells you to buy or sell anything. Do your own research.