Post
X conversation update
3 related posts from @hedera, @maddenifico
Bonzo Lend, a DeFi lending protocol on Hedera, suffered a $9 million exploit after an attacker used $5 of collateral to borrow $9 million, exploiting a vulnerability in the SUPRA oracle verification layer. The incident occurred on July 11, 2026, and Hedera confirmed core network services were not compromised.
The attacker deposited minimal collateral and exploited a flaw in the oracle verification contract operated by SUPRA_Labs, allowing them to borrow vastly more than the collateral value. The protocol's own contracts functioned as designed, but the oracle feed was manipulated.
SUPRA_Labs acknowledged the exploit and deployed a fix to the affected contract on Hedera mainnet. Hedera is supporting Bonzo Finance and working with security experts to analyze the attack. The stolen funds have not been recovered.
Bonzo FinanceLend and borrow on Hedera, non-custodiallyBonzo Finance is an open source, non-custodial protocol designed to facilitate the lending and borrowing of cryptocurrencies, with a focus on $HBAR, native $USDC, Hedera ecosystem assets, and wrapped (bridged) majors. Bonzo prioritizes censorship resistance, security, and self-custody, enabling users to transact without reliance on trusted intermediaries. Bonzo Finance utilizes Supra and Chainlink oracles that enable accurate and reliable price feeds for the lending and borrowing of assets, ensuring transparent and efficient operations.
HederaEnterprise-grade decentralized network for real-time consensusHedera is a decentralized public network where developers can build secure, fair applications with near real-time consensus. The platform is owned and governed by a council of global innovators including Avery Dennison, Boeing, Deutsche Telekom, DLA Piper, FIS (WorldPay), Google, IBM, LG Electronics, Magalu, Nomura, Swirlds, Tata Communications, University College London (UCL), Wipro, and Zain Group. The Hedera Consensus Service (HCS) acts as a trust layer for any application or permissioned network and allows for the creation of an immutable and verifiable log of messages. Application messages are submitted to the Hedera network for consensus, given a trusted timestamp, and fairly ordered. Use HCS to track assets across a supply chain, create auditable logs of events in an advertising platform, or even use it as a decentralized ordering service.
3 related posts from @hedera, @maddenifico
Hedera confirms an incident affecting Bonzo Lend, stating core network was not compromised and pointing to third-party oracle verifier issue.
A technical thread explaining how $9 million was borrowed against $5 of collateral due to an oracle failure, and why oracles are critical in DeFi.