QooryBeta
Back to narratives
SecurityActive
Conversation intelligence

Bonzo Lend Exploited for $9M via Oracle Manipulation on Hedera

Bonzo Lend, a DeFi lending protocol on Hedera, suffered a $9 million exploit after an attacker used $5 of collateral to borrow $9 million, exploiting a vulnerability in the SUPRA oracle verification layer. The incident occurred on July 11, 2026, and Hedera confirmed core network services were not compromised.

Heat
109
Confidence
95%
Evidence
8
Updated

Why It Happened

The attacker deposited minimal collateral and exploited a flaw in the oracle verification contract operated by SUPRA_Labs, allowing them to borrow vastly more than the collateral value. The protocol's own contracts functioned as designed, but the oracle feed was manipulated.

Outcome So Far

SUPRA_Labs acknowledged the exploit and deployed a fix to the affected contract on Hedera mainnet. Hedera is supporting Bonzo Finance and working with security experts to analyze the attack. The stolen funds have not been recovered.

Actors

Bonzo FinanceLend and borrow on Hedera, non-custodially

Bonzo Finance is an open source, non-custodial protocol designed to facilitate the lending and borrowing of cryptocurrencies, with a focus on $HBAR, native $USDC, Hedera ecosystem assets, and wrapped (bridged) majors. Bonzo prioritizes censorship resistance, security, and self-custody, enabling users to transact without reliance on trusted intermediaries. Bonzo Finance utilizes Supra and Chainlink oracles that enable accurate and reliable price feeds for the lending and borrowing of assets, ensuring transparent and efficient operations.

HederaEnterprise-grade decentralized network for real-time consensus

Hedera is a decentralized public network where developers can build secure, fair applications with near real-time consensus. The platform is owned and governed by a council of global innovators including Avery Dennison, Boeing, Deutsche Telekom, DLA Piper, FIS (WorldPay), Google, IBM, LG Electronics, Magalu, Nomura, Swirlds, Tata Communications, University College London (UCL), Wipro, and Zain Group. The Hedera Consensus Service (HCS) acts as a trust layer for any application or permissioned network and allows for the creation of an immutable and verifiable log of messages. Application messages are submitted to the Hedera network for consensus, given a trusted timestamp, and fairly ordered. Use HCS to track assets across a supply chain, create auditable logs of events in an advertising platform, or even use it as a decentralized ordering service.

SUSUPRA_Labsoracle provider
Timeline order

Post
Parent event 01

X conversation update

3 related posts from @hedera, @maddenifico

Related posts@hedera@hedera@maddenifico
@hederaOfficial X
Open on X34.6K views · 704 likes · 153 reposts
@hederaOfficial X
Open on X22.7K views · 363 likes · 100 reposts
@maddenifico
Open on X159.0K views · 2.2K likes · 1.4K reposts

Post
Parent event 02

Hedera Acknowledges Incident

Hedera confirms an incident affecting Bonzo Lend, stating core network was not compromised and pointing to third-party oracle verifier issue.

Related posts@hedera@hedera
@hederaOfficial X
Open on X120.1K views · 741 likes · 178 reposts
@hederaOfficial X
Open on X248.6K views · 477 likes · 112 reposts

Post
Parent event 03

X conversation update

2 related posts from @bonzo_finance

Related posts@bonzo_finance@bonzo_finance
@bonzo_financeOfficial X
Open on X120.1K views · 741 likes · 178 reposts
@bonzo_financeOfficial X
Open on X248.6K views · 477 likes · 112 reposts

Post
Parent event 04

MarcinRedStone explainer on oracle failure

A technical thread explaining how $9 million was borrowed against $5 of collateral due to an oracle failure, and why oracles are critical in DeFi.

Related posts@MarcinRedStone
@MarcinRedStone
Open on X4.3K views · 86 likes · 14 reposts