Bonzo Lend hack — July 2026

Bonzo Lend, the largest lending market on Hedera, was drained on 11 July 2026. Bonzo's incident report timestamps the first malicious transaction at 00:51:39 UTC and puts the principal extracted by the attacking wallet at $9.05 million, made up of 6,634,528.20 USDC and 34,518,389.36 wrapped HBAR. A second wallet borrowed roughly $1 million using the same technique and then identified itself in Bonzo's Discord as a white-hat responder intending to return the funds, which is why that amount sits outside the headline figure. CoinDesk, citing Bonzo, puts total principal borrowed during the incident at about $10.06 million before recovery; that wider figure includes the second wallet.

The fault was not in Bonzo's own contracts. Bonzo Lend took collateral prices from Supra, a third-party oracle. Supra's on-chain verifier validated BLS signatures with a pairing operation but did not first reject degenerate inputs, so a price update submitted with a zeroed signature and a zeroed committee key produced a pairing result of true and was written on-chain as authentic. The attacker used this to inflate the recorded price of SAUCE, the SaucerSwap token, by roughly twelve orders of magnitude against its real value of about 0.2 HBAR, deposited 250 SAUCE as collateral, and borrowed the pool's USDC and wrapped HBAR reserves against it.

Bonzo Lend was paused at 01:41 UTC and its points programme shortly after; the protocol's vaults, bridge and staking were unaffected. Supra acknowledged the flaw and deployed a fix to the verifier contract. Bonzo Lend's total value locked fell 77% within a day, and Hedera's overall DeFi total value locked fell about 40% to $25.7 million. Bonzo Finance Foundation later said it would fund the full recovery of affected Bonzo Lend positions as they stood immediately before the exploit, valued as of 00:51:39 UTC on 11 July 2026, backed by a recovery facility committed by the Hedera Foundation.