Bonzo Finance Loses $9 Million In Hedera Oracle Price Manipulation Attack

Bonzo Finance, a lending protocol built on Hedera, confirmed that an attacker borrowed close to $9 million after manipulating a third-party price oracle. The company said its own smart contracts were not at fault. Bonzo Lend and its points program have been paused while the team works on recovery.

How The Attack Unfolded

On-chain researcher Specter first spotted funds moving toward Ethereum before linking the activity back to Bonzo Finance. According to Bonzo’s own report, the attacker deposited just 250 SAUCE tokens, worth a few dollars, as collateral. They then pushed a fake SAUCE price into the oracle feed, inflating it by roughly twelve orders of magnitude.

Within seconds, the attacker borrowed about 6.6 million USDC and 34.5 million Wrapped HBAR against that tiny deposit. A second wallet borrowed roughly $1 million during the same window and later identified itself as a white-hat actor, saying it would return the funds.

Part Of A Larger Pattern This Month

The Bonzo exploit adds to a growing list of crypto hacks in July. Data from DefiLlama shows three separate incidents this month with combined losses topping $28 million, including a $6 million exploit on Summer.fi and a $20 million governance attack targeting BONK DAO.

A recent SlowMist report found security incidents rose about 50% in the first half of 2026, even as total dollar losses declined.