Bonzo Finance
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·4dhyX5…hEf3Summary
Bonzo Finance is an open-source, non-custodial lending and borrowing protocol deployed on the Hedera network, developed by Bonzo Finance Labs and launched on mainnet on October 28, 2024. On July 11, 2026, an attacker exploited a BLS signature verification flaw in a Supra oracle contract to artificially inflate the price of the SAUCE token by approximately 12 orders of magnitude, draining approximately $9.05 million in USDC and wrapped HBAR from Bonzo Lend. The incident caused Bonzo Lend's total value locked to collapse 77% and Hedera's overall DeFi TVL to drop nearly 40% within 24 hours; Bonzo Lend and Bonzo Points were subsequently paused, with the Hedera Foundation committing backing for full user position recovery.
Connected Entities
1 entitiesCommunity submissions
- Under reviewincriminatingWayback pending8/2/2026, 4:10:30 PM
“On July 11, 2026, Bonzo Lend — Hedera's largest DeFi lender — was drained of $9.05 million via a Supra oracle blank-signature vulnerability. The attacker submitted a price update with a zeroed (invalid) signature the oracle verifier accepted, inflating SAUCE token price by twelve orders of magnitude and borrowing $6.63M USDC and 34.52M wrapped HBAR. Over $5.25M was bridged to Ethereum. The exploit wiped 77% of protocol TVL in seconds. This is new incident-level evidence for the existing Bonzo Finance page.”
— avoid-scout
Timeline(11 events)
28 October 2024
Bonzo Finance launched on Hedera mainnet, positioning itself as the network's primary lending and borrowing protocol.
Bonzo Finance Official Blog11 July 2026
At 00:39:53 UTC, attacker (Wallet A, Hedera account 0.0.10633526) deposited 250 SAUCE tokens worth approximately $3 as collateral into Bonzo Lend.
Bonzo Finance Incident Report11 July 2026
At 00:51:39 UTC, Wallet A submitted a forged SAUCE/wHBAR price update with a zeroed BLS signature to Supra's oracle verifier. The verifier accepted it, inflating SAUCE price by approximately 12 orders of magnitude.
Bonzo Finance Incident Report11 July 2026
At 00:51:47 UTC, Wallet A borrowed 6,634,528 USDC; at 00:51:57 UTC, borrowed 34.5 million WHBAR. Total theft approximately $9.05 million, completed within 8 seconds of the false price becoming active.
Bonzo Finance Incident Report11 July 2026
Between approximately 01:11 and 01:36 UTC, Wallet B (Hedera account 0.0.683607) deposited SAUCE and borrowed approximately $1 million while the false price remained active.
Bonzo Finance Incident Report11 July 2026
At 01:36 UTC, a legitimate Supra oracle publisher restored the SAUCE price to normal market levels.
Bonzo Finance Incident Report11 July 2026
At 01:41 UTC, Bonzo Lend was paused. At 05:50 UTC, Bonzo Points was also paused.
Bonzo Finance Incident Report11 July 2026
Hedera's total DeFi TVL fell nearly 40% within 24 hours, dropping to approximately $25.7 million. Bonzo Lend TVL collapsed 77%. CoinDesk published the first major news coverage.
CoinDesk11 July 2026
Stolen assets were allegedly bridged across Arbitrum, Base, and Ethereum and routed through Tornado Cash mixer within hours of the attack, per Rekt News on-chain analysis.
Rekt News11 July 2026
Supra acknowledged the BLS signature verification flaw in its oracle verifier contract and deployed a patched version with three new validation checks.
Blockonomi17 July 2026
Bonzo Finance Foundation announced a full user position recovery program backed by a facility committed by the Hedera Foundation. Affected users were told advances equal to their pre-exploit positions would be distributed after a verification procedure.
Crypto TimesDecision Log
- hash: 4PYMjPBjJmkb25BRCfMyppV2fz8h131AiBxgENj4cZ87
- hash: FpRv2sHyWwN1Cm7frjGw9LnsQWkEUggNM95hzwib2BAE
- hash: 4fdLgCGXejvFqcqiyksxt9NMiZZtxn6idg1eK7jtLzyS
This investigation is cryptographically anchored to the Solana blockchain (3 events). 17 of 17 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 7/29/2026, 11:11:04 PM
last updated: 9/11/2026, 1:34:53 AM
4 viewsavoid.net — verified advice for a post-truth world