On July 11, 2026 at 00:51 UTC, an attacker deposited 250 SAUCE tokens (~$5 worth) as collateral on Bonzo Lend on Hedera. Attacker pushed a fabricated SAUCE price into Supra's oracle inflated by ~12 orders of magnitude, then borrowed 6.63M USDC and 34.5M WHBAR. Bonzo's TVL fell 77%; Hedera's network TVL dropped 40% within 24 hours.

Bonzo Lend on Hedera was exploited through a third-party oracle (Supra) vulnerability. An attacker submitted a massively manipulated SAUCE price, allowing them to borrow approximately $9.05 million in assets with minimal collateral. The borrowed funds were subsequently swapped on SaucerSwap and bridged to Ethereum via LayerZero (over $5M tracked on-chain). Bonzo Lend paused the protocol shortly after detecting abnormal activity.