Lending protocol Bonzo loses 77% of value locked as $9 million oracle exploit rattles Hedera
The Bonzo lending protocol on the Hedera network suffered a $9 million exploit due to a manipulated price oracle. The incident caused a 40% drop in Hedera's total value locked as the attacker drained USDC and HBAR assets.
Why it matters
This highlights the persistent vulnerability of decentralized finance (DeFi) protocols to oracle manipulation, posing significant risks to network liquidity and investor confidence.
The attacker deposited 250 SAUCE tokens with little value, before submitting a manipulated price update that inflated the token’s HBAR-denominated value, according to a preliminary incident report from Bonzo.
The protocol said the account subsequently borrowed 6.63 million USDC and 34.52 million wrapped HBAR. At the report’s reference HBAR price of $0.06998, the two withdrawals were worth approximately $9.05 million.
A second wallet, the report adds, borrowed roughly $1 million of additional assets while the abnormal price remained active. The wallet later contacted Bonzo through Discord, identified itself as a white-hat responder to the incident and said it intended to return the funds.
Bonzo excluded those assets from its headline loss estimate, placing total principal borrowed during the incident at approximately $10.06 million before recovery.
Get smarter about the news
Sign up free for a feed built around what you actually care about, Dive Deeper research on any story, and the full text of every article.
Create free accountAlready have an account? Sign in