# Bonzo Lend loses $9 million in Supra oracle exploit on Hedera

**Published:** 2026-07-12T01:23:43.423Z  
**Topic:** Hedera  
**Sentiment:** neutral  
**Publisher:** TrendWatcher — https://www.trendwatcher.in/article/15ecf3f2-c4a8-4bc3-8a09-dbf210ec2e9b

Bonzo Lend on Hedera hit by a $9 million oracle hack on July 11, wiping out 77% of its TVL and pausing the protocol amid rising 2026 DeFi attacks.

Bonzo Lend on the Hedera blockchain lost roughly $9 million after an attacker manipulated the price of the SAUCE token via a flaw in Supra’s on‑chain oracle verifier, wiping out about 77% of the protocol’s value locked on July 11 2026 [4]. The loss underscores growing security concerns in DeFi, where 2026 has already seen a record‑high number of exploits and a sharp decline in total value locked.

| At a glance | |
|---|---|
| Loss | $9 million (≈ 77% of TVL) |
| Date | July 11 2026 |
| Collateral token | SAUCE (inflated price) |
| Catalyst | Supra oracle verifier flaw |

## How the exploit unfolded  
The attacker deposited 250 SAUCE tokens—worth only a few dollars—into Bonzo Lend and then fed a dramatically inflated price into Supra’s oracle verifier contract. With the on‑chain price appearing legitimate, the protocol allowed the attacker to borrow roughly 6.6 million USDC and 34.5 million Wrapped HBAR (WHBAR) in a single transaction [3]. A second wallet extracted an additional $1 million before the breach was identified. Bonzo Finance traced the breach to the third‑party oracle rather than its own smart contracts and subsequently paused the lending platform and its points program while recovery efforts continue [3].

## Wider DeFi security backdrop  
The incident adds to a surge of DeFi attacks in 2026. The second quarter of the year recorded 83 exploits totaling about $755 million, making it the most‑hacked quarter on record [1]. Overall, DeFi’s total value locked fell 39% from $115 billion in January to just over $70 billion in June [1]. CryptoRank logged 121 hacks and roughly $942 million in losses for the year, suggesting that repeated security breaches are eroding user confidence and prompting capital outflows [1].

## Response and open questions  
Bonzo Lend has issued no detailed public statement regarding compensation, remediation, or whether the oracle vulnerability has been patched [2]. The silence leaves liquidity providers uncertain about the safety of remaining funds and raises questions about the protocol’s treasury or insurance capacity to cover the nine‑figure loss [2]. The exploit also spotlights the need for deeper stress‑testing of oracle verification logic across Hedera‑based projects.

## What to watch  
- **Oracle updates:** Monitor any patch releases or migration announcements from Supra concerning its verifier contract.  
- **Protocol activity:** Watch for the re‑opening of Bonzo Lend’s lending pool or points program, which would signal confidence in the fix.  
- **Hedera DeFi health:** Track TVL trends on Hedera‑based platforms; a further decline could indicate contagion risk from this exploit.

The $9 million breach not only decimated Bonzo Lend’s locked value but also serves as a stark reminder that oracle verification flaws remain a critical attack surface in DeFi, especially as the sector grapples with a record number of hacks and shrinking capital.

## Sources
1. Cointelegraph — [Bonzo Lend loses $9M in oracle exploit on Hedera](https://cointelegraph.com/news/bonzo-lend-9m-oracle-exploit-hedera)
2. The Currency Analytics — [Bonzo Lend Loses $9 Million After Supra Oracle Flaw Hits Hedera](https://thecurrencyanalytics.com/altcoins/bonzo-lend-loses-9-million-after-supra-oracle-flaw-hits-hedera-274683)
3. BeInCrypto — [Hedera-Based Bonzo Lend Loses $9 Million in Oracle Exploit](https://beincrypto.com/hedera-exploit-5-million-ethereum-bridge/)
4. CoinDesk — [Lending protocol Bonzo loses 77% of value locked as $9 million oracle exploit rattles Hedera](https://www.coindesk.com/web3/2026/07/11/lending-protocol-bonzo-loses-77-of-value-locked-as-usd9-million-oracle-exploit-rattles-hedera)

---
Cite as: TrendWatcher, "Bonzo Lend loses $9 million in Supra oracle exploit on Hedera", https://www.trendwatcher.in/article/15ecf3f2-c4a8-4bc3-8a09-dbf210ec2e9b