DeFi Protocol Drained of $9.5M Through Manipulated Oracle Update

A DeFi protocol named Bonzo Lend on Hedera was drained of approximately $9.5 million in stablecoins and wrapped HBAR through a manipulated oracle update.

The incident occurred at around 00:51 UTC on July 11, 2026, when an attacker posted about 250 SAUCE as collateral and submitted a price update that inflated SAUCE by roughly 12 orders of magnitude.

The verifier contract accepted the update despite a zeroed or invalid signature, which should have failed. This is the weak link in the oracle system, where external truths are relied upon for prices, attestations, and state roots.

Bonzo paused the protocol to stem further damage, and Supra deployed a fix to the affected verifier on Hedera mainnet. The incident highlights the importance of proper oracle verification and the need for lenders and oracle teams to be vigilant in their operations.