Bonzo Lend
Summary
Bonzo Lend is a decentralized lending and borrowing protocol on the Hedera network, adapted from the Aave v2 codebase and formerly the largest DeFi lending protocol on Hedera by total value locked. On July 11, 2026, the protocol suffered a $9.05 million loss when an attacker exploited a critical signature verification flaw in its third-party Supra oracle provider, inflating the SAUCE token price by approximately twelve orders of magnitude and borrowing assets far in excess of deposited collateral. Protocol operations remain paused pending a Halborn-audited recovery contract deployment backed by the Hedera Foundation.
Connected Entities
1 entities · 10 linked investigationsTimeline(11 events)
2024-02-01
Bonzo Finance wins first place in the Hedera bounty category at ETHDenver 2024 BuidlWeek ('Data-Driven DeFi: Revolutionize Finance with Oracle Feeds'), having adapted Aave v2 to Hedera's EVM and integrated Supra oracles.
Bonzo Finance Blog / Devfolio2026-06-29
Supra deploys a patched oracle verifier to Base, beginning a multi-chain update rollout that would cover at least eleven blockchains by July 3, 2026. Hedera is not included in this patch wave.
Protos2026-07-03
Supra completes oracle verifier patches on Polygon and other chains. The Hedera deployment of the same flawed verifier remains unpatched.
Protos2026-07-11
At approximately 00:39 UTC, Wallet A (Hedera 0.0.10633526) deposits 250 SAUCE tokens worth approximately $3 into Bonzo Lend as collateral.
Bonzo Finance Incident Report2026-07-11
At 00:51:39 UTC, Wallet A submits a manipulated SAUCE/HBAR price update to Supra's pull oracle contract with a zeroed BLS signature (signature field [0,0]) and a zero committee public key. Supra's verifier accepts the update, inflating SAUCE's price by approximately twelve orders of magnitude.
Bonzo Finance Incident Report / CryptoSlate2026-07-11
At 00:51:47 UTC, Wallet A borrows 6.63 million USDC against the inflated collateral. At 00:51:57 UTC, Wallet A borrows 34.52 million WHBAR. Total principal extracted: approximately $9.05 million.
Bonzo Finance Incident Report2026-07-11
Stolen funds are bridged to Ethereum via LayerZero and routed through Stargate to Arbitrum and Base. Approximately $5.25 million is converted to ETH and WBTC and subsequently deposited into Tornado Cash. The attacker's Ethereum receiving wallet had been pre-seeded with 1 ETH from Tornado Cash approximately ten hours before the exploit.
CryptoTimes / Rekt News2026-07-11
Between 01:11 and 01:36 UTC, a second account (Wallet B, Hedera 0.0.683607) borrows approximately $1.0 million in assets under the same inflated price conditions. At 01:36 UTC, a legitimate oracle update restores the correct SAUCE price. At 01:41 UTC, Bonzo Lend is paused.
Bonzo Finance Incident Report2026-07-11
Hedera's network-wide TVL drops approximately 40% to $25.7 million within 24 hours. Bonzo Lend's TVL falls 77% following the incident.
CoinDesk2026-07-13
Supra CEO Joshua Tobkin publicly offers the attacker a 72-hour window to return stolen funds, proposing the attacker retain $100,000, receive no prosecution, and be guaranteed employment at Supra. Tobkin warns of a permanently growing bounty for anyone who eventually turns the attacker in.
CoinSpectator / Rekt News2026-07-17
Bonzo Finance Foundation announces a recovery program backed by the Hedera Foundation to restore all affected user positions to their pre-exploit values. New redemption smart contracts are announced as under development, pending a Halborn security audit.
CryptoTimesDecision Log
- #1publish⛓ pending7/26/2026, 5:12:01 PMhash: 4RgdMEVybBgf2SVFAbAohafz7ZZwNuusGjpigYnXkdBr
0 of 20 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 7/26/2026, 5:11:53 PM
last updated: 7/26/2026, 5:12:01 PM
avoid.net — verified advice for a post-truth world