Bonzo lost approximately $9.00 million due to an oracle attack, with the attacker manipulating the SAUCE price to borrow a huge amount of assets.

PANewsJul 11, 2026
#DeFi HBAR-0.91%USDC-0.00%SUPRA-6.15%
A lending protocol based on Hedera, Bonzo Finance, has suffered an oracle attack, resulting in losses of approximately $9.00 million. The attacker utilized collateral where the SAUCE token price was abnormally inflated to borrow assets from the protocol far exceeding their actual value.

Bonzo's initial incident report indicates that the attacker deposited only 250 SAUCE tokens (worth only a few dollars) and subsequently submitted a price update, artificially inflating the token's price by approximately 12 orders of magnitude. Following this, the address borrowed $6.63 million $USDC and 34.50 million wrapped $HBAR (wHBAR) from the lending pool.

It is understood that this incident stemmed from a vulnerability in the on-chain oracle validator of oracle service provider $Supra, which erroneously accepted SAUCE price data with a zeroed signature.

[PANews]

Source
Powered by ChatGPT
All You Need to Know in 10s
Your One-Stop Crypto Investment Powerhouse

Bonzo lost approximately $9.00 million due to an oracle attack, with the attacker manipulating the SAUCE price to borrow a huge amount of assets.

PANewsJul 11, 2026
#DeFi HBAR-0.91%USDC-0.00%SUPRA-6.15%
A lending protocol based on Hedera, Bonzo Finance, has suffered an oracle attack, resulting in losses of approximately $9.00 million. The attacker utilized collateral where the SAUCE token price was abnormally inflated to borrow assets from the protocol far exceeding their actual value.

Bonzo's initial incident report indicates that the attacker deposited only 250 SAUCE tokens (worth only a few dollars) and subsequently submitted a price update, artificially inflating the token's price by approximately 12 orders of magnitude. Following this, the address borrowed $6.63 million USDC and 34.50 million wrapped HBAR (wHBAR) from the lending pool.

It is understood that this incident stemmed from a vulnerability in the on-chain oracle validator of oracle service provider Supra, which erroneously accepted SAUCE price data with a zeroed signature.

[PANews]

Powered by ChatGPT
Scan QR Code to Explore more key information
One-stop financial research platform for Crypto Investors