Attack on DeFi protocol Bonzo Lend: $9 million loss due to oracle manipulation
The Hedera ecosystem has faced a serious security incident: the DeFi protocol Bonzo Lend was attacked, resulting in the theft of approximately $9 million in assets. The key cause of the hack was the compromise of a third-party price oracle, Supra, rather than a vulnerability in the protocol's own smart contracts.
According to a detailed analysis by the Bonzo Finance team, the attacker used a sophisticated scheme. Only 250 SAUCE tokens were deposited as collateral. The hacker then fed a fake price for this asset to the oracle, artificially inflating it by roughly a trillion times. This allowed them to borrow approximately 6.6 million USDC and 34.5 million wHBAR with virtually no collateral. In essence, manipulating the price feed enabled them to bypass collateral valuation mechanisms and drain pool liquidity.
After detecting the attack, the Bonzo Lend team immediately suspended the lending service and the points accrual program. The developers emphasized that the incident was specifically related to an error in the price verification system of the oracle provider Supra, not to flaws in the protocol's own code. Active cooperation is underway with partners in the Hedera ecosystem to analyze the incident and prepare a plan for fund recovery.
Notably, one of the addresses involved in withdrawing approximately $1 million during the anomalous SAUCE price identified itself as a "white hat hacker" and stated its intention to return the funds. This offers hope for partial compensation of the losses, but the fate of the remaining $8 million remains uncertain.
Expert Commentary: This incident is yet another reminder of the critical role of oracles in DeFi. Even the most reliable smart contracts are useless if an external data source (in this case, a price feed) can be compromised. The attack on Bonzo Lend demonstrates that projects need to implement multi-layered price verification systems and use decentralized oracles with anti-manipulation mechanisms. Otherwise, we will continue to see similar scenarios, especially given that losses from attacks in the first half of the year have already exceeded $972 million.