Bonzo Finance
Summary
Bonzo Finance is an open-source, non-custodial lending and borrowing protocol deployed on the Hedera network, developed by Bonzo Finance Labs and launched on mainnet on October 28, 2024. On July 11, 2026, an attacker exploited a BLS signature verification flaw in a Supra oracle contract to artificially inflate the price of the SAUCE token by approximately 12 orders of magnitude, draining approximately $9.05 million in USDC and wrapped HBAR from Bonzo Lend. The incident caused Bonzo Lend's total value locked to collapse 77% and Hedera's overall DeFi TVL to drop nearly 40% within 24 hours; Bonzo Lend and Bonzo Points were subsequently paused, with the Hedera Foundation committing backing for full user position recovery.
Connected Entities
1 entities · 10 linked investigationsTimeline(11 events)
2024-10-28
Bonzo Finance launched on Hedera mainnet, positioning itself as the network's primary lending and borrowing protocol.
Bonzo Finance Official Blog2026-07-11
At 00:39:53 UTC, attacker (Wallet A, Hedera account 0.0.10633526) deposited 250 SAUCE tokens worth approximately $3 as collateral into Bonzo Lend.
Bonzo Finance Incident Report2026-07-11
At 00:51:39 UTC, Wallet A submitted a forged SAUCE/wHBAR price update with a zeroed BLS signature to Supra's oracle verifier. The verifier accepted it, inflating SAUCE price by approximately 12 orders of magnitude.
Bonzo Finance Incident Report2026-07-11
At 00:51:47 UTC, Wallet A borrowed 6,634,528 USDC; at 00:51:57 UTC, borrowed 34.5 million WHBAR. Total theft approximately $9.05 million, completed within 8 seconds of the false price becoming active.
Bonzo Finance Incident Report2026-07-11
Between approximately 01:11 and 01:36 UTC, Wallet B (Hedera account 0.0.683607) deposited SAUCE and borrowed approximately $1 million while the false price remained active.
Bonzo Finance Incident Report2026-07-11
At 01:36 UTC, a legitimate Supra oracle publisher restored the SAUCE price to normal market levels.
Bonzo Finance Incident Report2026-07-11
At 01:41 UTC, Bonzo Lend was paused. At 05:50 UTC, Bonzo Points was also paused.
Bonzo Finance Incident Report2026-07-11
Hedera's total DeFi TVL fell nearly 40% within 24 hours, dropping to approximately $25.7 million. Bonzo Lend TVL collapsed 77%. CoinDesk published the first major news coverage.
CoinDesk2026-07-11
Stolen assets were allegedly bridged across Arbitrum, Base, and Ethereum and routed through Tornado Cash mixer within hours of the attack, per Rekt News on-chain analysis.
Rekt News2026-07-11
Supra acknowledged the BLS signature verification flaw in its oracle verifier contract and deployed a patched version with three new validation checks.
Blockonomi2026-07-17
Bonzo Finance Foundation announced a full user position recovery program backed by a facility committed by the Hedera Foundation. Affected users were told advances equal to their pre-exploit positions would be distributed after a verification procedure.
Crypto TimesDecision Log
- #1publish⛓ pending7/29/2026, 11:11:12 PMhash: 4fdLgCGXejvFqcqiyksxt9NMiZZtxn6idg1eK7jtLzyS
16 of 17 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 7/29/2026, 11:11:04 PM
last updated: 7/30/2026, 3:30:07 AM
avoid.net — verified advice for a post-truth world