Bonzo Lend loses about $9 million in SAUCE oracle exploit

Bonzo Lend said it lost about $9.05 million after an attacker manipulated the value of SAUCE used as collateral, turning a deposit of 250 SAUCE worth only a few dollars into enough borrowing power to drain large amounts from the protocol’s lending pool. Bonzo Finance Labs said the incident began on July 11, 2026, when a wallet submitted a false SAUCE price to a third-party Supra oracle contract. Eight seconds after the manipulated price reached Hedera mainnet, the wallet borrowed 6.63 million USDC and more than 34.5 million wrapped HBAR. Bonzo said the exploit stemmed from Supra’s signature verification process, which accepted a zeroed signature instead of a valid signature from Supra’s oracle committee. The protocol said no valid oracle signature was forged and SAUCE’s real market price did not rise. Supra has since deployed a fix to the affected verifier contract on Hedera mainnet, while Bonzo said its own lending contracts simply read the approved oracle feed and acted as designed. Bonzo paused Bonzo Lend at 01:41 UTC and later stopped Bonzo Points, while Bonzo Vaults, Bonzo Bridge and single-sided BONZO staking continued operating. The team also said a second wallet borrowed about $1 million during the abnormal pricing window and later identified itself as a white-hat responder that planned to return the assets, though the return had not been confirmed. Bonzo excluded that amount from its $9.05 million loss figure. Researchers had earlier traced more than $5.8 million from Hedera to Ethereum through LayerZero, with part of the holdings converted from wrapped Bitcoin into Ether.