Key Takeaways:
An attacker drained $9.05 million from Bonzo Lend after exploiting a Supra oracle verification flaw to inflate SAUCE token collateral on Hedera.
"The attacker deposited 250 SAUCE tokens, which held minimal value, before submitting a falsified price update that dramatically inflated the token's value in HBAR," Bonzo Lend said in its preliminary incident report.
The flaw sat inside Supra's on-chain oracle verifier — the logic that confirms whether a reported price is valid — rather than in a centralized price feed. By gaming that verification process, the attacker posted the overvalued SAUCE as collateral and borrowed assets far exceeding the token's real worth, according to the report.
The exploit adds to a growing tally of DeFi security failures. The second quarter became the most-hacked quarter on record by incident count, with 83 exploits and about $755 million stolen, according to CryptoRank. Cross-chain bridge attacks accounted for $351 million of that total, while compromised administrator attacks and fake token price manipulation represented 37 percent of quarterly losses.
The Bonzo incident follows a similar collateral-pricing exploit on Stellar. In February, attackers drained roughly $10 million from a YieldBlox DAO-managed lending pool after manipulating the price path used to value USTRY collateral, according to reports.
DeFi's total value locked across all chains fell 39 percent to about $70 billion in June from roughly $115 billion in January, CryptoRank data shows. The research firm recorded 121 hacks and roughly $942 million in losses over the period, saying repeated security incidents likely weighed on user confidence and reinforced capital outflows.
Bonzo Lend has not disclosed a timeline for patching the vulnerability or a plan for compensating affected users. The protocol's silence leaves liquidity providers and depositors uncertain whether funds remain at risk, as the broader Hedera DeFi ecosystem watches for signs of contagion.
This article is for informational purposes only and does not constitute investment advice.
