{"id":"bonzo-lend-oracle-theft-jul-2026","category":"breach","status":"live","title":"Bonzo Lend loses US$9.05 million through false token price; user recovery remains incomplete","tldr":"Bonzo Lend users face losses after a false price feed enabled US$9.05 million in borrowing. The verifier was fixed, but recovery remains incomplete. Claims are targeted for the week of 9 November; wait for official instructions.","summary":"On 11 July, an attacker extracted approximately US$9.05 million in principal from Bonzo Lend, a crypto lending service on Hedera. A flaw in Supra’s price-feed signature checks allowed an unauthorised SAUCE price update, making a small collateral deposit appear enormously valuable. Bonzo paused lending and withdrawals. Bonzo said Supra fixed the affected verifier; its vaults, bridge and staking products were unaffected. A separate wallet borrowed roughly US$1 million and later completed settlement repayments, retaining a 10% bounty. Return of the main attacker’s funds has not been confirmed in the reviewed updates. Although Bonzo initially announced full compensation, its 30 October plan estimated recovery of about 81% overall, measured at pre-incident prices, with some users still facing substantial losses. As of 3 November, claims opening remained conditional and was targeted for the week of 9 November.","action":"If you supplied assets to Bonzo Lend, wait for the confirmed claims opening and use instructions reached through Bonzo’s official website. Read the recovery terms before claiming: they will include a release of claims relating to the incident and recovery. Never share your wallet recovery phrase or private keys.","product":"Bonzo Lend crypto lending service on Hedera","audience":"both","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["bonzo","hedera","supra","crypto-theft","defi","oracle-manipulation"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"advisory","title":"Bonzo Lend Incident Report: Oracle Provider Exploit","url":"https://bonzo.finance/blog/bonzo-lend-incident-report-oracle-provider-exploit","by":"Bonzo Finance Labs","date":"2026-07-11"},{"kind":"post","title":"Hedera Foundation Issues Compensation for Bonzo Finance Impacted Users","url":"https://bonzo.finance/blog/hedera-foundation-issues-compensation-for-bonzo-finance-impacted-users","by":"Bonzo Finance Labs","date":"2026-07-16"},{"kind":"post","title":"Recovery & Relaunch: What's Been Done, When, and What's Next","url":"https://bonzo.finance/blog/recovery-and-relaunch-what-s-been-done-when-and-whats-next","by":"Bonzo Finance Labs","date":"2026-08-18"},{"kind":"post","title":"Bonzo Recovery Update: Claims Mechanism and Opening Timeline","url":"https://bonzo.finance/blog/bonzo-recovery-update-claims-mechanism-and-opening-timeline","by":"Bonzo Finance Labs","date":"2026-10-30"},{"kind":"research","title":"~$36M Lost: Summer.fi, Bonzo Lend & More | BlockSec Weekly","url":"https://blocksec.com/blog/web3-security-summerfi-bonzo-lend-exploits","by":"BlockSec","date":"2026-07-15"},{"kind":"news","title":"Hedera lending protocol Bonzo Lend hit for $9 million after Supra verifier accepts manipulated price update","url":"https://www.theblock.co/news/defi/2026-07-11-hedera-lending-protocol-bonzo-lend-hit-for-9-million-after-supra-verifier-accepts-manipulated-price-update-407960","by":"The Block","date":"2026-07-11"},{"kind":"news","title":"How a zeroed oracle signature unlocked $9M from Hedera DeFi lender Bonzo Lend","url":"https://cryptoslate.com/how-a-zeroed-oracle-signature-unlocked-9m-from-hedera-defi-lender-bonzo-lend/","by":"CryptoSlate","date":"2026-07-13"}],"started":"2026-07-11","closed":null,"created":"2026-11-03T21:44:45.485Z","updated":"2026-11-03T21:44:45.485Z","cve_notes":[],"timeline":[{"at":"2026-10-30","added":"2026-11-03T21:35:43.306Z","kind":"vendor-revised","text":"Bonzo’s revised plan estimated 81% aggregate recovery for 2,535 eligible accounts, with individual estimates of 56% to 100%, rather than full compensation for everyone. Claims were targeted for the week of 9 November, conditional on funding and final checks; Hedera Foundation had approved 795,431 USDC.","url":"https://bonzo.finance/blog/bonzo-recovery-update-claims-mechanism-and-opening-timeline","by":"Bonzo Finance Labs","patch":null},{"at":"2026-08-06","added":"2026-11-03T21:35:43.306Z","kind":"other","text":"The separate wallet that identified itself as a white-hat responder completed four settlement repayments. Bonzo’s 18 August update confirmed repayment reconciliation was complete and the pool remained paused.","url":"https://bonzo.finance/blog/recovery-and-relaunch-what-s-been-done-when-and-whats-next","by":"Bonzo Finance Labs","patch":null},{"at":"2026-07-16","added":"2026-11-03T21:35:43.306Z","kind":"other","text":"Bonzo announced a Hedera Foundation-backed programme intended to cover the full pre-incident value of affected users’ losses. Payments had not opened, and the lending markets remained paused.","url":"https://bonzo.finance/blog/hedera-foundation-issues-compensation-for-bonzo-finance-impacted-users","by":"Bonzo Finance Labs","patch":null},{"at":"2026-07-15T14:43Z","added":"2026-11-03T21:35:43.306Z","kind":"other","text":"Bonzo completed checks confirming interest rates had been reduced to approximately zero across all 14 lending pools. The pools remained frozen and paused.","url":"https://bonzo.finance/blog/recovery-and-relaunch-what-s-been-done-when-and-whats-next","by":"Bonzo Finance Labs","patch":null},{"at":"2026-07-11T01:41Z","added":"2026-11-03T21:35:43.306Z","kind":"other","text":"Bonzo paused its lending pool, five minutes after a legitimate price update restored SAUCE’s normal value. Bonzo Points was paused at 05:50 UTC; its vaults, bridge and BONZO/XBONZO staking were unaffected.","url":"https://bonzo.finance/blog/bonzo-lend-incident-report-oracle-provider-exploit","by":"Bonzo Finance Labs","patch":null},{"at":"2026-07-11T00:51Z","added":"2026-11-03T21:35:43.306Z","kind":"other","text":"An attacker submitted a false SAUCE token price through Supra’s price-feed service. Against 250 SAUCE deposited earlier, the attacker borrowed about 6.63 million USDC and 34.5 million wrapped HBAR, approximately US$9.05 million in principal.","url":"https://bonzo.finance/blog/bonzo-lend-incident-report-oracle-provider-exploit","by":"Bonzo Finance Labs","patch":"na"},{"at":"2026-07-11","added":"2026-11-03T21:35:43.306Z","kind":"disclosed","text":"Bonzo published its preliminary report, identifying a signature-verification failure in Supra’s upstream price-feed contracts. Bonzo said Supra had deployed a fix to the affected verifier on Hedera mainnet.","url":"https://bonzo.finance/blog/bonzo-lend-incident-report-oracle-provider-exploit","by":"Bonzo Finance Labs","patch":null}],"url":"https://hard.fyi/live/bonzo-lend-oracle-theft-jul-2026/","json":"https://hard.fyi/api/live?id=bonzo-lend-oracle-theft-jul-2026"}