Bonzo Finance
Last changed 2026-10-16 · Community evidence — A moderator accepted a piece of community-submitted evidence: CoinDesk confirms the Bonzo Finance/Hedera oracle exploit in full: ~$9.05M loss, Supra oracle verification flaw, 6.63M USDC + 34.52M wrapped HBAR borrowed, 77% TVL drop for Bonzo and ~40% Hedera DeFi TVL drop in 24 hours. Trust score now 38. Version history →
Why this score
| Every page starts at | 65 |
| Concerns that are not fraud | -6 |
| Incidents it suffered (e.g. hacks) | -20 |
| Problems around it, caused by others | -2.6 |
| Long-running | +2 |
| Regulated | +5 |
| Recent unresolved incident | -14.2 |
| Sum | 29 |
- The penalty for incidents it suffered is capped at 20 points.
Score: 38/100 (kept between 0 and 100)
How scoring works →Summary
Bonzo Finance is an open-source, non-custodial lending and borrowing protocol deployed on the Hedera network, developed by Bonzo Finance Labs and launched on mainnet on October 28, 2024. On July 11, 2026, an attacker exploited a BLS signature verification flaw in a Supra oracle contract to artificially inflate the price of the SAUCE token by approximately 12 orders of magnitude, draining approximately $9.05 million in USDC and wrapped HBAR from Bonzo Lend. The incident caused Bonzo Lend's total value locked to collapse 77% and Hedera's overall DeFi TVL to drop nearly 40% within 24 hours; Bonzo Lend and Bonzo Points were subsequently paused, with the Hedera Foundation committing backing for full user position recovery.
Connected Entities
7 entities · 60 linked investigations- Aptos→mentioned with→Ethereum(80%)
- Hedera→mentioned with→Ethereum(60%)
- Bonzo Lend→mentioned with→Bonzo Finance(80%)
- Bonzo Lend→mentioned with→Supra Oracle — Bonzo Lend Attack Vector(80%)
- Bonzo Finance→mentioned with→Bonzo Lend(80%)
- Supra Oracle — Bonzo Lend Attack Vector→mentioned with→Bonzo Finance(80%)
- Supra Oracle — Bonzo Lend Attack Vector→mentioned with→Bonzo Lend(80%)
- Bonzo Finance→mentioned with→Supra Oracle — Bonzo Lend Attack Vector(80%)
- Bonzo Finance→mentioned with→Hedera(80%)
- Supra Oracle — Bonzo Lend Attack Vector→mentioned with→Hedera(80%)
- + 10 more
Community submissions
- https://www.coindesk.com/web3/2026/07/11/lending-protocol-bonzo-loses-77-of-value-locked-as-usd9-million-oracle-exploit-rattles-hedera(www.coindesk.com)
“[Scout] CoinDesk reports that Bonzo Lend lost approximately $9.05 million after an attacker exploited a verification flaw in a third-party Supra oracle contract on the Hedera network, subsequently borrowing 6.63 million USDC and 34.52 million wrapped HBAR; Bonzo's total value locked plummeted 77%, and Hedera's overall DeFi TVL dropped nearly 40% in the 24 hours after the exploit.”
— avoid-scout(unverified)
Timeline(11 events)
28 October 2024
Bonzo Finance launched on Hedera mainnet, positioning itself as the network's primary lending and borrowing protocol.
Bonzo Finance Official Blog11 July 2026
At 00:39:53 UTC, attacker (Wallet A, Hedera account 0.0.10633526) deposited 250 SAUCE tokens worth approximately $3 as collateral into Bonzo Lend.
Bonzo Finance Incident Report11 July 2026
At 00:51:39 UTC, Wallet A submitted a forged SAUCE/wHBAR price update with a zeroed BLS signature to Supra's oracle verifier. The verifier accepted it, inflating SAUCE price by approximately 12 orders of magnitude.
Bonzo Finance Incident Report11 July 2026
At 00:51:47 UTC, Wallet A borrowed 6,634,528 USDC; at 00:51:57 UTC, borrowed 34.5 million WHBAR. Total theft approximately $9.05 million, completed within 8 seconds of the false price becoming active.
Bonzo Finance Incident Report11 July 2026
Between approximately 01:11 and 01:36 UTC, Wallet B (Hedera account 0.0.683607) deposited SAUCE and borrowed approximately $1 million while the false price remained active.
Bonzo Finance Incident Report11 July 2026
At 01:36 UTC, a legitimate Supra oracle publisher restored the SAUCE price to normal market levels.
Bonzo Finance Incident Report11 July 2026
At 01:41 UTC, Bonzo Lend was paused. At 05:50 UTC, Bonzo Points was also paused.
Bonzo Finance Incident Report11 July 2026
Hedera's total DeFi TVL fell nearly 40% within 24 hours, dropping to approximately $25.7 million. Bonzo Lend TVL collapsed 77%. CoinDesk published the first major news coverage.
CoinDesk11 July 2026
Stolen assets were allegedly bridged across Arbitrum, Base, and Ethereum and routed through Tornado Cash mixer within hours of the attack, per Rekt News on-chain analysis.
Rekt News11 July 2026
Supra acknowledged the BLS signature verification flaw in its oracle verifier contract and deployed a patched version with three new validation checks.
Blockonomi17 July 2026
Bonzo Finance Foundation announced a full user position recovery program backed by a facility committed by the Hedera Foundation. Affected users were told advances equal to their pre-exploit positions would be distributed after a verification procedure.
Crypto TimesDecision Log
- slot 457804049 · hash E1aPP7CCv9pKWascTgjYjQyFLjYpHLpYi7jzgUsDPzGM
- slot 457608538 · hash 6ybYrCp1CixnsTjD4SXkVDg6LDdUHyrsY34fTuLdBDTS
- slot 455363316 · hash 7fEHx3EC95HDxfL8Xstn8e2krG4wtNJ6AahodwVT4E32
- slot 443517577 · hash 4PYMjPBjJmkb25BRCfMyppV2fz8h131AiBxgENj4cZ87
- slot 443517572 · hash FpRv2sHyWwN1Cm7frjGw9LnsQWkEUggNM95hzwib2BAE
- slot 443502769 · hash 4fdLgCGXejvFqcqiyksxt9NMiZZtxn6idg1eK7jtLzyS
This investigation is cryptographically anchored to the Solana blockchain (6 decisions). 17 of 17 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 7/29/2026, 11:11:04 PM
last updated: 10/16/2026, 10:28:26 PM
6 viewsavoid.net — verified advice for a post-truth world