Breaches and incidentsBriefConfirmed by two or more outlets
Bonzo Lend (Hedera): oracle verifier accepted a zeroed signature
11 Jul 2026: about USD 9M lost (6.63M USDC and 34.5M wrapped HBAR borrowed against 250 SAUCE worth a few dollars).
- Disclosed
What happened
- Root cause per Bonzo: a flaw in Supra’s on-chain oracle verifier, which accepted a manipulated SAUCE price carrying an empty (zeroed) signature, inflating its value by about 12 orders of magnitude. Bonzo says its own contracts and Hedera were not at fault.
- Attribution: none.
- Response: Supra deployed a verifier fix. Bonzo paused the market. Reimbursement with Hedera Foundation support is reported by some outlets; not confirmed in the source fetched.
Sources
- https://cointelegraph.com/news/bonzo-lend-9m-oracle-exploit-hedera
- https://thedefiant.io/news/hacks/bonzo-lend-loses-9m-on-hedera-in-supra-oracle-exploit
- https://web3isgoinggreat.com/single/bonzo-lend-exploit
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.