Bonzo Lend loses US$9.05 million through false token price; user recovery remains incomplete
Bonzo Lend users face losses after a false price feed enabled US$9.05 million in borrowing. The verifier was fixed, but recovery remains incomplete. Claims are targeted for the week of 9 November; wait for official instructions.
If you supplied assets to Bonzo Lend, wait for the confirmed claims opening and use instructions reached through Bonzo’s official website. Read the recovery terms before claiming: they will include a release of claims relating to the incident and recovery. Never share your wallet recovery phrase or private keys.
What’s happening
On 11 July, an attacker extracted approximately US$9.05 million in principal from Bonzo Lend, a crypto lending service on Hedera. A flaw in Supra’s price-feed signature checks allowed an unauthorised SAUCE price update, making a small collateral deposit appear enormously valuable. Bonzo paused lending and withdrawals. Bonzo said Supra fixed the affected verifier; its vaults, bridge and staking products were unaffected. A separate wallet borrowed roughly US$1 million and later completed settlement repayments, retaining a 10% bounty. Return of the main attacker’s funds has not been confirmed in the reviewed updates. Although Bonzo initially announced full compensation, its 30 October plan estimated recovery of about 81% overall, measured at pre-incident prices, with some users still facing substantial losses. As of 3 November, claims opening remained conditional and was targeted for the week of 9 November.
- What
- Breach
- Affects
- Bonzo Lend crypto lending service on Hedera
- Fixed in
- Nothing to patch
- Since
- 11 July 2026
Timeline
- Vendor revised
Bonzo’s revised plan estimated 81% aggregate recovery for 2,535 eligible accounts, with individual estimates of 56% to 100%, rather than full compensation for everyone. Claims were targeted for the week of 9 November, conditional on funding and final checks; Hedera Foundation had approved 795,431 USDC.
- Update
The separate wallet that identified itself as a white-hat responder completed four settlement repayments. Bonzo’s 18 August update confirmed repayment reconciliation was complete and the pool remained paused.
- Update
Bonzo announced a Hedera Foundation-backed programme intended to cover the full pre-incident value of affected users’ losses. Payments had not opened, and the lending markets remained paused.
- Update
Bonzo completed checks confirming interest rates had been reduced to approximately zero across all 14 lending pools. The pools remained frozen and paused.
- Update
Bonzo paused its lending pool, five minutes after a legitimate price update restored SAUCE’s normal value. Bonzo Points was paused at 05:50 UTC; its vaults, bridge and BONZO/XBONZO staking were unaffected.
- UpdateNothing to patch
An attacker submitted a false SAUCE token price through Supra’s price-feed service. Against 250 SAUCE deposited earlier, the attacker borrowed about 6.63 million USDC and 34.5 million wrapped HBAR, approximately US$9.05 million in principal.
- Made public
Bonzo published its preliminary report, identifying a signature-verification failure in Supra’s upstream price-feed contracts. Bonzo said Supra had deployed a fix to the affected verifier on Hedera mainnet.
Sources
- Bonzo Lend Incident Report: Oracle Provider ExploitBonzo Finance Labs · 11 July 2026
- Hedera Foundation Issues Compensation for Bonzo Finance Impacted UsersBonzo Finance Labs · 16 July 2026
- Recovery & Relaunch: What's Been Done, When, and What's NextBonzo Finance Labs · 18 Aug 2026
- Bonzo Recovery Update: Claims Mechanism and Opening TimelineBonzo Finance Labs · 30 Oct 2026
- ~$36M Lost: Summer.fi, Bonzo Lend & More | BlockSec WeeklyBlockSec · 15 July 2026
- Hedera lending protocol Bonzo Lend hit for $9 million after Supra verifier accepts manipulated price updateThe Block · 11 July 2026
- How a zeroed oracle signature unlocked $9M from Hedera DeFi lender Bonzo LendCryptoSlate · 13 July 2026