Bonzo Lend, a decentralised lending protocol on Hedera, said in a preliminary report that an attacker took about US$9.05 million by exploiting a verification flaw in third-party oracle Supra and inflating the value of SAUCE tokens used as collateral.

Bonzo said the issue was in Supra’s Hedera verifier, not Bonzo’s lending contracts, because the oracle accepted zeroed inputs and wrote a false SAUCE price on-chain.

SAUCE is the native token of SaucerSwap, a decentralised exchange on Hedera, and was an approved collateral asset on Bonzo.

Bonzo said the attacker’s wallet deposited 250 SAUCE tokens, then used the manipulated price to borrow 6.63 million USDC and 34.52 million wrapped HBAR. A second wallet borrowed about US$1 million more before the abnormal price was removed.

The company said the second wallet later contacted the protocol on Discord, identified itself as a white hat actor, and said it intended to return the funds.

Bonzo said the protocol is paused and has not yet detailed remediation or reimbursement plans. Supra has acknowledged the issue and deployed a fix to the affected verifier.

Bonzo’s total value locked (TVL) fell 77%, while DeFiLlama data showed Hedera’s TVL fell nearly 40% in 24 hours to US$25.7 million after the incident.

🔗 Source: CoinDesk