Bonzo Lend exploit analysis

Bonzo Lend, the largest lending protocol on Hedera, was drained of about $9 million on 10 July 2026 after the attacker manipulated Supra's price oracle into accepting a falsified SAUCE price update. The Block was first to report the approximate loss, citing a SupraVerifier error that allowed an attacker-constructed price feed to pass the protocol's sanity checks. Within hours the figure settled around $9.05 million across multiple crypto outlets.

The attacker deposited a small quantity of a low-value token, used the forged oracle update to register that deposit as worth far more than its actual market price, and borrowed against the inflated collateral. On-chain reporting tied the borrowed proceeds to roughly $6.63 million in USDC and 34.5 million in wrapped HBAR, valued at the time at about $2.4 million. Across multiple outlets the consensus figure is $9 million, with Blockonomi's $9.05 million tally the most precise of the early estimates.

The technical detail mattered because Supra is a shared oracle across many chains. Protos reported that Supra had patched the same vulnerability on 11 other chains before the Bonzo exploit was discovered. The patch path that Bonzo would have used was the same one Supra had already shipped elsewhere. By the time the patch was promoted to Hedera, the attacker had already executed.

Bonzo announced it would reimburse affected users, drawing on treasury funds and with support from the Hedera Foundation. The native BONZO token lost roughly 77 percent of its value locked in the immediate aftermath, per CoinDesk.

The Bonzo incident fits a recurring shape: a shared oracle that updates on a chain-by-chain cadence creates a window where one chain is patched while another is not. Reading the codebase against the patched chain would have caught the gap before anyone could borrow against it.

This analysis was prepared by reading the web3isgoinggreat timeline entry on the incident, which links reporting from The Block, CryptoSlate, Blockonomi, and CoinDesk.