Oracle Vulnerability Triggers $9 Million Drain on Hedera’s Bonzo Lend

The stability of the Hedera ecosystem faced a significant setback this week as a price verification failure in a third-party oracle contract allowed attackers to drain approximately $9.05 million from Bonzo Lend. The exploit, which targeted a vulnerability in a Supra oracle, has resulted in a nearly 40% collapse in the total value locked (TVL) across the network.

According to a preliminary incident report from Bonzo Lend, the attacker utilized a mere 250 SAUCE tokens to initiate the drain. By submitting a manipulated price update that artificially inflated the value of those tokens relative to HBAR, the exploiter was able to bypass standard collateral requirements. This allowed the withdrawal of 34.52 million wrapped HBAR and 6.63 million USDC, effectively stripping the protocol of its core liquidity.

The incident highlights the persistent risks associated with price feeds in decentralized finance, where a single point of failure in a third-party smart contract can compromise an entire lending platform. Bonzo Lend noted that the attacker’s HBAR-denominated valuation of the collateral was entirely detached from market reality, yet the protocol’s reliance on the flawed Supra verification logic permitted the massive loans.

A secondary wallet was also identified as having borrowed roughly $1 million during the period of abnormal pricing. However, that individual later contacted the protocol via Discord, identifying as a white-hat responder with the intention of returning the funds. Bonzo Lend has excluded these assets from its primary loss estimate, which originally stood at $10.06 million before accounting for the potential recovery.

The fallout has been immediate for the broader network. Data from DeFiLlama indicates that Hedera’s TVL plummeted to $25.7 million following the exploit. The rapid exit of capital underscores the fragility of liquidity in emerging blockchain environments when core infrastructure components fail.