Bonzo Lend

February 2024

Bonzo Finance wins first place in the Hedera bounty category at ETHDenver 2024 BuidlWeek ('Data-Driven DeFi: Revolutionize Finance with Oracle Feeds'), having adapted Aave v2 to Hedera's EVM and integrated Supra oracles.

29 June 2026

Supra deploys a patched oracle verifier to Base, beginning a multi-chain update rollout that would cover at least eleven blockchains by July 3, 2026. Hedera is not included in this patch wave.

3 July 2026

Supra completes oracle verifier patches on Polygon and other chains. The Hedera deployment of the same flawed verifier remains unpatched.

11 July 2026

At approximately 00:39 UTC, Wallet A (Hedera 0.0.10633526) deposits 250 SAUCE tokens worth approximately $3 into Bonzo Lend as collateral.

11 July 2026

At 00:51:39 UTC, Wallet A submits a manipulated SAUCE/HBAR price update to Supra's pull oracle contract with a zeroed BLS signature (signature field [0,0]) and a zero committee public key. Supra's verifier accepts the update, inflating SAUCE's price by approximately twelve orders of magnitude.

11 July 2026

At 00:51:47 UTC, Wallet A borrows 6.63 million USDC against the inflated collateral. At 00:51:57 UTC, Wallet A borrows 34.52 million WHBAR. Total principal extracted: approximately $9.05 million.

11 July 2026

Stolen funds are bridged to Ethereum via LayerZero and routed through Stargate to Arbitrum and Base. Approximately $5.25 million is converted to ETH and WBTC and subsequently deposited into Tornado Cash. The attacker's Ethereum receiving wallet had been pre-seeded with 1 ETH from Tornado Cash approximately ten hours before the exploit.

11 July 2026

Between 01:11 and 01:36 UTC, a second account (Wallet B, Hedera 0.0.683607) borrows approximately $1.0 million in assets under the same inflated price conditions. At 01:36 UTC, a legitimate oracle update restores the correct SAUCE price. At 01:41 UTC, Bonzo Lend is paused.

11 July 2026

Hedera's network-wide TVL drops approximately 40% to $25.7 million within 24 hours. Bonzo Lend's TVL falls 77% following the incident.

13 July 2026

Supra CEO Joshua Tobkin publicly offers the attacker a 72-hour window to return stolen funds, proposing the attacker retain $100,000, receive no prosecution, and be guaranteed employment at Supra. Tobkin warns of a permanently growing bounty for anyone who eventually turns the attacker in.

17 July 2026

Bonzo Finance Foundation announces a recovery program backed by the Hedera Foundation to restore all affected user positions to their pre-exploit values. New redemption smart contracts are announced as under development, pending a Halborn security audit.