Bonzo Lend, a decentralized lending protocol on the Hedera network, suffered an estimated loss of $9.05 million after an attacker exploited a verification flaw in a third-party Supra oracle contract, allowing them to borrow assets that far exceed the value of their collateral.
The attacker deposited 250 SAUCE tokens of little value before sending a manipulated price update that inflated the token’s HBAR-denominated value, according to a preliminary incident report from Bonzo.
The protocol said the account subsequently borrowed 6.63 million USDC and 34.52 million wrapped HBAR. At the report’s reference HBAR price of $0.06998, the two payouts were worth about $9.05 million.
Another wallet, the report adds, borrowed about $1 million of additional assets while the abnormal price remained active. The wallet later contacted Bonzo through Discord, identified itself as a white-hat responder to the incident, and said it intended to return the money.
Bonzo excluded these assets from its overall loss estimate and placed the total borrowed principal during the event at approx. $10.06 million before recovery.
According to DeFLlama data, Hedera now has $25.7 million in total value locked (TVL). The number dropped almost 40% in the last 24 hours after the exploit. With Bonzo’s TVL
