Fact-check findings

The reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.

1. #2[disputed][awaiting moderator]in section: Protocol Background

   “that audit concluded that Bonzo Lend's own contracts contained no critical vulnerabilities.”

   reviewerBonzo Finance Labs engaged Halborn Security for a smart contract audit, and that audit concluded Bonzo Lend's own contracts contained no critical vulnerabilities.The page's cited source directly contradicts the claim as phrased. Halborn's audit found 4 critical-severity issues in Bonzo Lend's contracts (since remediated), not zero. The Supra-out-of-scope portion of the sentence is separately unverifiable, since the Halborn report page does not mention Supra or oracle infrastructure at all.
   Proposed correction (not yet applied)

   that audit identified four critical vulnerabilities in Bonzo Lend's own contracts, all of which were remediated before mainnet launch.
   citedwww.halborn.com/audits/bonzo-finance/sma…ssessment-78bdba
2. #7[disputed][awaiting moderator]in section: Fund Movement and On-Chain Trail

   “A second wallet (EVM address 0xaf20D792A19fD42dCf697ceBa6100291D96dD93e) was also identified in on-chain analysis.”

   reviewerA second wallet with EVM address 0xaf20D792A19fD42dCf697ceBa6100291D96dD93e was a separate ('second') wallet from Wallet A, and is the same wallet as Wallet B which borrowed approximately $1 million and self-identified as a white-hat.The page's own cited source (Rekt News) attributes this specific address to Wallet A's post-bridging activity, not to a distinct second/white-hat wallet. As written, the sentence misleadingly implies this address belongs to Wallet B, immediately followed by a sentence that does describe Wallet B. This conflates the primary attacker's bridged funds trail with the separate white-hat wallet.
   Proposed correction (not yet applied)

   An EVM address linked to Wallet A, used once its stolen funds were bridged to Ethereum (0xaf20D792A19fD42dCf697ceBa6100291D96dD93e), was also identified in on-chain analysis.
   citedrekt.news/bonzo-finance-rekt

No source the reviewer could reach confirms or contradicts the claim.

1. #3[unverifiable][awaiting moderator]in section: Protocol Background

   “The Supra oracle infrastructure that Bonzo Lend relied upon was outside the scope of that engagement.”

   reviewerThe Supra oracle infrastructure that Bonzo Lend relied upon was outside the scope of the Halborn audit engagement.No source explicitly states the Supra oracle was formally excluded from Halborn's scope; it is a reasonable inference from the listed scope and from the fact that the exploit originated in a third-party contract Halborn never reviewed, but not a sourced fact as written.
   citedwww.halborn.com/audits/bonzo-finance/sma…ssessment-78bdba
2. #4[unverifiable][awaiting moderator]in section: Protocol Background

   “Brady Gentile holds a B.S. in Management (Entrepreneurship) from Arizona State University and previously worked at both Hedera and Swirlds Labs in marketing and product roles, accumulating over six years of experience in the Hedera ecosystem.”

   reviewerBrady Gentile holds a B.S. in Management (Entrepreneurship) from Arizona State University and previously worked at both Hedera and Swirlds Labs in marketing and product roles, accumulating over six years of experience in the Hedera ecosystem.A podcast transcript found independently has Gentile describing roughly five and a half years at 'Hedera/the Hashgraph organization,' in the same range as 'over six years,' but no source I could reach mentions Arizona State University or Swirlds Labs by name specifically, and none of the sections' cited sources support this sentence.
   citeddocs.bonzo.finance/hub/contributors/team
3. #17[unverifiable][awaiting moderator]in the timeline

   “Supra acknowledged the BLS signature verification flaw in its oracle verifier contract and deployed a patched version with three new validation checks.”

   reviewerSupra acknowledged the BLS signature verification flaw and deployed a patched version on July 11, 2026 (the same day as the exploit).The content of the acknowledgment/patch is well corroborated (see separate finding on the Supra quote), but no source I could reach confirms the patch was deployed specifically on July 11, 2026 as opposed to some day shortly afterward; the timeline entry's date could be inexact.
   citedblockonomi.com/bonzo-lend-loses-9-05m-in…ed-to-supra-flaw

The cited evidence supports part of the claim but not all of it.

1. #11[partially supported][awaiting moderator]in section: Market and Ecosystem Impact

   “Lloyds Banking Group, Aberdeen, and Archax executed what was described as the United Kingdom's first foreign exchange transaction using tokenized real-world assets on Hedera around the same period, illustrating a contrast between Hedera's institutional adoption trajectory and its DeFi security track record.”

   reviewerLloyds Banking Group, Aberdeen, and Archax executed the UK's first FX transaction using tokenized real-world assets on Hedera 'around the same period' as the July 2026 exploit.The transaction itself and its 'UK first' characterization are real, but no source supports the implication that it happened in the same window as the July 2026 exploit; the announcement/case study predates the exploit by roughly six months or more.

The cited evidence supports the claim as written.

1. #1[confirmed][no action needed]in section: Protocol Background

   “The protocol launched on Hedera mainnet on October 28, 2024, and positioned itself as 'the liquidity layer of Hedera.'”

   reviewerBonzo Finance launched on Hedera mainnet on October 28, 2024.Launch date independently confirmed against the official recap blog post cited in the timeline for this same fact.
   citedbonzo.finance/blog/bonzo-finance-pioneer…-for-hedera-defi
2. #5[confirmed][no action needed]in section: Protocol Background

   “developed by Bonzo Finance Labs, co-founded by Brady Gentile (Co-Founder and CEO) and Gaurang (Co-Founder and CTO).”

   reviewerCo-Founder and CTO Gaurang leads Bonzo Finance Labs alongside Brady Gentile.Roles match the cited official team page verbatim.
   citeddocs.bonzo.finance/hub/contributors/team
3. #6[confirmed][no action needed]in section: July 11, 2026 Oracle Exploit — Attack Mechanics

   “On July 11, 2026, at approximately 00:51:39 UTC, an attacker identified as Wallet A (Hedera account 0.0.10633526; EVM address 0x9a4966152f6e10b33cb7a37975e8619816d6a494) exploited a critical flaw in Supra's on-chain oracle verifier contract (Hedera account 0.0.4323006, function requireHashVerified_V2) to drain approximately $9.05 million from Bonzo Lend.”

   reviewerOn July 11, 2026 at approximately 00:51:39 UTC, Wallet A exploited Supra's requireHashVerified_V2 verifier (account 0.0.4323006) to drain approximately $9.05 million from Bonzo Lend, via a zeroed BLS signature on a manipulated SAUCE/wHBAR price (pair 425), with the attack sequence (deposit, reconnaissance update, forged update, borrows) as described.Fully corroborated by both the primary incident report and independent news coverage.
   citedbonzo.finance/blog/bonzo-lend-incident-r…provider-exploit
4. #8[confirmed][no action needed]in section: Fund Movement and On-Chain Trail

   “Final tracked holdings were reported at approximately $5.25 million, including approximately 2,360 ETH and 15.58 WBTC, following conversion to more liquid assets.”

   reviewerThe primary attacker's funds were bridged across Arbitrum, Base and Ethereum before reaching Tornado Cash, with final tracked holdings of approximately $5.25 million including about 2,360 ETH and 15.58 WBTC.Figures match the cited research source closely.
   citedrekt.news/bonzo-finance-rekt
5. #9[confirmed][no action needed]in section: Market and Ecosystem Impact

   “Bonzo Lend's total value locked collapsed by approximately 77% in the immediate aftermath. Hedera's network-wide TVL dropped by nearly 40% within 24 hours, falling to approximately $25.7 million.”

   reviewerBonzo Lend's total value locked collapsed approximately 77% and Hedera's network-wide TVL dropped nearly 40% within 24 hours, falling to approximately $25.7 million.Independently confirmed against the cited CoinDesk article.
   citedwww.coindesk.com/web3/2026/07/11/lending…t-rattles-hedera
6. #10[confirmed][no action needed]in section: Market and Ecosystem Impact

   “HBAR, Hedera's native token, was trading at approximately $0.067 to $0.069 in the days following the incident, down approximately 71% year-over-year, though the exact portion of this decline attributable to the exploit versus broader market conditions is not established.”

   reviewerHBAR traded at approximately $0.067-$0.069 in the days following the incident, down approximately 71% year-over-year.Both the absolute price range and the rough YoY decline are corroborated by independent market data; the page's own hedge about attribution to the exploit vs. broader market is appropriately cautious.
   citedcryptorank.io/news/feed/54f82-hbar-news-today
7. #12[confirmed][no action needed]in section: July 11, 2026 Oracle Exploit — Attack Mechanics

   “Wallet B subsequently contacted the Bonzo Finance team via its official Discord server, identified itself as a white-hat responder, and indicated intent to return the borrowed funds.”

   reviewerWallet B self-identified as a white-hat responder by contacting the Bonzo Finance team via its official Discord server and indicating intent to return the borrowed funds.Matches the official incident report.
   citedbonzo.finance/blog/bonzo-lend-incident-r…provider-exploit
8. #13[confirmed][no action needed]in section: Root Cause: Supra Oracle BLS Signature Verification Flaw

   “Supra stated that 'the identity-element check alone would have prevented this attack.'”

   reviewerSupra deployed a patched verifier with three new validation steps (range validation, rejection of identity-element keys/signatures, on-curve validation), and stated 'the identity-element check alone would have prevented this attack.'Quote and patch description both corroborated by the cited Rekt News analysis; the official Bonzo and CryptoDaily sources mention the patch only in general terms without this detail, so Rekt News is the operative source.
   citedrekt.news/bonzo-finance-rekt
9. #14[confirmed][no action needed]in section: Root Cause: Supra Oracle BLS Signature Verification Flaw

   “The flawed verifier contract had been publicly visible on-chain for approximately two years before exploitation. According to Rekt News, the contract had never undergone a security review; Supra's only named oracle audit covered contracts written in Move for the Aptos blockchain — an entirely different environment.”

   reviewerThe flawed Supra verifier contract had been publicly visible on-chain for approximately two years before exploitation, and Supra's only named oracle audit covered Move/Aptos contracts, not this Hedera verifier.Matches the cited Rekt News reporting closely.
   citedrekt.news/bonzo-finance-rekt
10. #15[confirmed][no action needed]in section: Root Cause: Supra Oracle BLS Signature Verification Flaw

    “Additionally, Bonzo Finance's own bug bounty program explicitly classified third-party dependencies as out-of-scope, meaning the vulnerability would not have triggered a reward had it been discovered and disclosed through that channel.”

    reviewerBonzo Finance's bug bounty program explicitly classified third-party dependencies as out-of-scope, meaning the Supra vulnerability would not have been eligible for a reward.Matches the cited source exactly.
    citedrekt.news/bonzo-finance-rekt
11. #16[confirmed][no action needed]in section: Protocol Response and Recovery Plan

    “On approximately July 17, 2026, the Bonzo Finance Foundation announced that affected users would receive advances equal to the full value of their positions as they stood immediately before the exploit. The Hedera Foundation committed a facility to back this recovery.”

    reviewerOn approximately July 17, 2026, the Bonzo Finance Foundation announced advances equal to users' full pre-exploit positions, backed by a Hedera Foundation facility, with no action required from users and payments made after a verification procedure.All elements of this claim, including the timeline entry's 'verification procedure' detail, are corroborated by the cited article.
    citedwww.cryptotimes.io/2026/07/17/bonzo-to-r…-hedera-backing/