Bonzo Lend’s total value locked plunged 77% after an oracle exploit on the Hedera network that produced an estimated $9.05 million loss. Bonzo Lend’s headline loss estimate of $9.05 million excluded some assets, resulting in a total principal borrowed related to the incident of about $10.06 million. The event reduced reported TVL sharply and concentrated roughly $9–10 million of assets in the affected positions.
The exploit against Bonzo Lend on the Hedera network involved an attacker taking advantage of a verification flaw in a third-party Supra oracle contract. The attacker began the exploit by depositing 250 SAUCE tokens into the system. Subsequently, the price of these tokens was manipulated, inflating their value and allowing the attacker to borrow assets at an artificially high price. As a result, the attacker succeeded in securing 6.63 million USDC and 34.52 million wrapped HBAR, cumulatively worth approximately $9.05 million, based on the manipulated pricing. During the time while the token’s price was distorted, a second wallet engaged in similar activity, borrowing roughly $1 million worth of additional assets. This significant loan from the secondary wallet contributed to the overall financial impact of the exploit.
In the aftermath of the Bonzo Lend exploit on Hedera, a white-hat responder asserted intentions to return the misappropriated funds via Discord, providing a potential avenue for recovery. Asset exclusions in Bonzo Lend’s headline loss estimate left the total borrowed principal at about $10.06 million.
The incident significantly impacted the Hedera network’s Total Value Locked (TVL), which fell to $25.7 million, marking a nearly 40% decline within a 24-hour period. The rapid TVL decrease underscores the severe financial shock and the potential recovery complexities relating to the technical exploit and subsequent responses.
The oracle exploit on the Hedera network produced a sharp plunge in Bonzo Lend’s total value locked, concentrating multi‑million dollar losses and significantly reducing the protocol’s reported liquidity. The incident, which involved manipulation of a third‑party oracle and subsequent borrowing from affected positions, drew a white‑hat response and prompted Bonzo Lend to revise its headline loss accounting, underscoring the operational risks of oracle vulnerabilities on Hedera.
