Bonzo Lend
Last changed 2026-10-10 · Score recalculated — Rescored under Scoring v2, the published formula (avoid.net/scoring): 22 → 43. Problems weighed by who is responsible: incidents the subject suffered −20, concerns that are not fraud −6, problems around the subject, caused by others −3.3; legitimacy credit long-running +4; the penalty for incidents it suffered is capped at 20; a recent unresolved incident −7.5. Version history →
Why this score
| Every page starts at | 65 |
| Concerns that are not fraud | -6 |
| Incidents it suffered (e.g. hacks) | -20 |
| Problems around it, caused by others | -3.3 |
| Long-running | +4 |
| Recent unresolved incident | -7.5 |
| Sum | 32 |
- The penalty for incidents it suffered is capped at 20 points.
Score: 43/100 (kept between 0 and 100)
How scoring works →Summary
Bonzo Lend is a decentralized lending and borrowing protocol on the Hedera network, adapted from the Aave v2 codebase and formerly the largest DeFi lending protocol on Hedera by total value locked. On July 11, 2026, the protocol suffered a $9.05 million loss when an attacker exploited a critical signature verification flaw in its third-party Supra oracle provider, inflating the SAUCE token price by approximately twelve orders of magnitude and borrowing assets far in excess of deposited collateral. Protocol operations remain paused pending a Halborn-audited recovery contract deployment backed by the Hedera Foundation.
Connected Entities
12 entities · 60 linked investigations- Stellar→mentioned with→Ethereum(60%)
- Aptos→mentioned with→Ethereum(80%)
- Hedera→mentioned with→Ethereum(60%)
- Bonzo Lend→mentioned with→LayerZero — DVN Single-Verifier Configuration Risk(80%)
- LayerZero — DVN Single-Verifier Configuration Risk→mentioned with→Ethereum(60%)
- Supra Oracle — Bonzo Lend Attack Vector→mentioned with→LayerZero — DVN Single-Verifier Configuration Risk(65%)
- Bonzo Lend→mentioned with→Bonzo Finance(80%)
- Bonzo Lend→mentioned with→Supra Oracle — Bonzo Lend Attack Vector(80%)
- Bonzo Finance→mentioned with→Bonzo Lend(80%)
- Supra Oracle — Bonzo Lend Attack Vector→mentioned with→Bonzo Finance(80%)
- + 23 more
Timeline(11 events)
February 2024
Bonzo Finance wins first place in the Hedera bounty category at ETHDenver 2024 BuidlWeek ('Data-Driven DeFi: Revolutionize Finance with Oracle Feeds'), having adapted Aave v2 to Hedera's EVM and integrated Supra oracles.
Bonzo Finance Blog / Devfolio29 June 2026
Supra deploys a patched oracle verifier to Base, beginning a multi-chain update rollout that would cover at least eleven blockchains by July 3, 2026. Hedera is not included in this patch wave.
Protos3 July 2026
Supra completes oracle verifier patches on Polygon and other chains. The Hedera deployment of the same flawed verifier remains unpatched.
Protos11 July 2026
At approximately 00:39 UTC, Wallet A (Hedera 0.0.10633526) deposits 250 SAUCE tokens worth approximately $3 into Bonzo Lend as collateral.
Bonzo Finance Incident Report11 July 2026
At 00:51:39 UTC, Wallet A submits a manipulated SAUCE/HBAR price update to Supra's pull oracle contract with a zeroed BLS signature (signature field [0,0]) and a zero committee public key. Supra's verifier accepts the update, inflating SAUCE's price by approximately twelve orders of magnitude.
Bonzo Finance Incident Report / CryptoSlate11 July 2026
At 00:51:47 UTC, Wallet A borrows 6.63 million USDC against the inflated collateral. At 00:51:57 UTC, Wallet A borrows 34.52 million WHBAR. Total principal extracted: approximately $9.05 million.
Bonzo Finance Incident Report11 July 2026
Stolen funds are bridged to Ethereum via LayerZero and routed through Stargate to Arbitrum and Base. Approximately $5.25 million is converted to ETH and WBTC and subsequently deposited into Tornado Cash. The attacker's Ethereum receiving wallet had been pre-seeded with 1 ETH from Tornado Cash approximately ten hours before the exploit.
CryptoTimes / Rekt News11 July 2026
Between 01:11 and 01:36 UTC, a second account (Wallet B, Hedera 0.0.683607) borrows approximately $1.0 million in assets under the same inflated price conditions. At 01:36 UTC, a legitimate oracle update restores the correct SAUCE price. At 01:41 UTC, Bonzo Lend is paused.
Bonzo Finance Incident Report11 July 2026
Hedera's network-wide TVL drops approximately 40% to $25.7 million within 24 hours. Bonzo Lend's TVL falls 77% following the incident.
CoinDesk13 July 2026
Supra CEO Joshua Tobkin publicly offers the attacker a 72-hour window to return stolen funds, proposing the attacker retain $100,000, receive no prosecution, and be guaranteed employment at Supra. Tobkin warns of a permanently growing bounty for anyone who eventually turns the attacker in.
CoinSpectator / Rekt News17 July 2026
Bonzo Finance Foundation announces a recovery program backed by the Hedera Foundation to restore all affected user positions to their pre-exploit values. New redemption smart contracts are announced as under development, pending a Halborn security audit.
CryptoTimesDecision Log
- slot 455362191 · hash J4zL8QBQ5edCoH23A6BTZ2CUELpRBzee9JGHr5sfMbfU
- slot 443502068 · hash 4RgdMEVybBgf2SVFAbAohafz7ZZwNuusGjpigYnXkdBr
This investigation is cryptographically anchored to the Solana blockchain (2 decisions). 20 of 20 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 7/26/2026, 5:11:53 PM
last updated: 10/10/2026, 6:42:33 PM
5 viewsavoid.net — verified advice for a post-truth world