Tools Crypto Exploit Tracker exploit-0023
Exploit record
Bonzo Lend
- Loss
- $9M
- Attack vector
- Oracle Manipulation
- Chain
- Hedera
- Sector
- Lending
What happened
Hedera's largest DeFi lender, Bonzo Lend, was exploited for about $9 million at 00:51 UTC on 11 July 2026 after a third-party oracle accepted a forged SAUCE token price.
The attacker submitted a SAUCE price inflated by twelve orders of magnitude, which the Supra oracle accepted after a signature verification bypass (a zeroed signature), then used 250 SAUCE worth about $1 as collateral to borrow $9.05 million from the protocol. Around $5.25 million was bridged to Ethereum, a white hat returned roughly $1 million, Bonzo paused the protocol and Supra acknowledged the flaw and deployed a fix; PeckShield tracked the bridged funds.
One record from the Crypto Exploit Tracker, maintained by the Security Desk. Data: CSV · JSON ·RSS · CC BY 4.0 with attribution to YFarmX.Tracker updated · 15 September 2026