Hedera-based lending protocol Bonzo Lend lost $9 million in an oracle manipulation exploit. An attacker deposited a small amount of SAUCE tokens, artificially inflated their price by 12 orders of magnitude, and used the fake collateral to borrow 6.63M USDC and 34.5M HBAR. The stolen funds were bridged to Ethereum. The incident, which caused Hedera's HBAR token to drop 3%, highlights ongoing security risks in DeFi.
Sauce Protocol exploit mechanics
- ▪The attacker deposited 250 SAUCE tokens, then submitted a price update that inflated the token's value by approximately 12 orders of magnitude
- ▪Oracle provider Supra acknowledged the issue and has deployed a fix
- ▪Lending protocol Bonzo Lend on the Hedera network lost about $9 million in an oracle manipulation exploit
- ▪Bonzo Lend stated the incident was not a vulnerability in its own smart contracts or in the Hedera core network
- ▪Using the artificially inflated collateral, the attacker borrowed 6.63 million USDC and 34.5 million wrapped HBAR from Bonzo Lend's pool
- ▪Bonzo Lend attributed the exploit to a flaw in Supra’s on-chain oracle verifier, which accepted a manipulated price with a zeroed signature
Stolen funds movement
- ▪The attacker initially funded their wallet with 1 ETH routed through the mixing service Tornado Cash
- ▪Security firm PeckShield reported the attacker's wallet held assets worth about $5.25 million, including approximately 2,360 ETH and 15.58 WBTC
- ▪The attacker's Ethereum addresses were identified as 0x9A4966152F6e10b33Cb7a37975e8619816d6a494 and 0xaf20D792A19fD42dCf697ceBa6100291D96dD93e
- ▪After the exploit, the attacker used the LayerZero bridge to move the stolen funds from the Hedera network to Ethereum
HBAR price impact
- ▪Following the news of the exploit, the price of Hedera's native token, HBAR, dropped by approximately 3-3.5%
- ▪The exploit raised security concerns across the decentralized finance (DeFi) ecosystem built on the Hedera blockchain
- ▪The price of HBAR fell to nearly $0.0670 after the incident
Investigation status
- ▪Bonzo Lend published a preliminary incident report, but the Hedera Network team had not issued an official statement as of July 11, 2026
- ▪The second quarter of 2026 was the most-hacked on record by incident count, with 83 exploits and about $755 million stolen from DeFi protocols
- ▪The incident was first flagged by blockchain researcher Specter, with security firm PeckShield also providing analysis
- ▪In a similar collateral-pricing exploit in February 2026, attackers stole roughly $10 million from a YieldBlox DAO lending pool on the Stellar network
Story comments
Loading comments…