$9M Lost: Bonzo Lend Oracle Exploit Exposes Hedera DeFi Risks

Bonzo Lend, the largest lending protocol on Hedera, has suffered a significant loss of $9 million due to an oracle exploit. The attack targeted a flaw in Supra's on-chain oracle verifier that allowed an attacker to manipulate the price of SAUCE collateral and borrow more than its actual value.

The vulnerability was used to inflate the value of SAUCE by manipulating its price feed, making it appear more valuable than it actually is. This enabled the attacker to borrow roughly $9 million in other assets from Bonzo's lending pools.

Bonzo Finance has previously experienced issues with oracle-related incidents, including a market pause in February 2025 due to suspicious HBAR pricing activity. The protocol relies on Supra's oracle service, but is exploring redundancy options with other providers like Pyth to reduce single-point-of-failure risk.