$9M Oracle Exploit Brings Down Bonzo Finance TVL by 77%

A major exploit on Hedera's Bonzo Finance platform has left its total value locked (TVL) plummeting by 77% after a malicious actor manipulated the price oracle logic to borrow assets against inflated collateral values.

The attack, which saw approximately $9.05 million siphoned from the protocol, highlights the cascading risk when DeFi applications depend on external price feeds without sufficient safeguards.

The vulnerability did not lie in Bonzo's own smart contracts but rather in a Supra oracle integration, demonstrating that protocols often overlook their reliance on third-party infrastructure.

Oracle exploits are not new to DeFi, but this incident stings for Hedera specifically because Bonzo had become one of the largest lending markets on the network.