Crisis Hits Hedera Network Altcoin: 77 Percent Evaporates in One Day

Bonzo Lend, a lending protocol operating on the Hedera network, suffered a loss of approximately $9 million after attackers exploited an oracle vulnerability.

The decentralized finance (DeFi) world has been shaken by news coming from the Hedera ecosystem. Bonzo Lend, one of the network’s prominent protocols, fell victim to a major cyber attack due to a validation error on Supra, a third-party data provider (oracle). This technical vulnerability allowed malicious actors to artificially inflate collateral values and borrow far more than the assets they held on the platform.

To trigger the exploit, the attacker initially deposited 250 SAUCE tokens, which were of very low value. They then submitted a manipulated price update that exploited the oracle error, inflating the value of these assets to unrealistic levels in HBAR terms. Through this fraudulent transaction, they managed to borrow 6.63 million USDC and 34.52 million wrapped HBAR from the platform. Based on prices at the time of the incident, the damage caused by the primary attacker is calculated to be approximately $9.05 million.

Oracle Exploit in Hedera Ecosystem and Million-Dollar Loss

Following the cyber attack, 77 percent of the total value locked in the Bonzo Lend protocol evaporated instantly. This situation also caused significant damage to the overall outlook of the Hedera network, leading to a 40 percent drop in its total value locked (TVL) over the last 24 hours. According to data, the total value on the network fell to $25.7 million. Technical analysis and complex code structures reflected on system screens clearly demonstrate how the attacker bypassed the price validation mechanism.

An interesting development occurred during the incident when another wallet was detected withdrawing approximately $1 million worth of assets. However, this wallet owner soon contacted the team via Discord, identifying themselves as a “white hat” hacker and stating their intention to return the funds. Although protocol officials kept this amount separate from the primary loss, they confirmed that the total principal exiting the system prior to recovery efforts was around $10.06 million.