Hedera DeFi Bonzo Lend Suffers $9.05 Million Exploit Due to Oracle 'Zero Signature' Vulnerability

On July 11, 2026, a security incident involving approximately $9.05 million occurred at Bonzo Lend, the largest lending protocol on the Hedera network. This incident exploited a vulnerability in the signature verification process of Supra, a third-party oracle service, sounding an alarm about oracle dependency in the DeFi ecosystem.

The attacker deposited only 250 SAUCE tokens as collateral and then used the oracle's 'zeroed signature' flaw to inflate the value of the asset by 12 digits. Through this, they succeeded in withdrawing a large amount of stablecoins and wrapped HBAR deposited within the protocol.

Immediately after becoming aware of the incident, Bonzo Finance Labs suspended protocol operations and froze all lending markets. Initial investigations revealed that the attacker manipulated the Supra oracle's price update mechanism to inject prices much higher than their actual value into the system.

This incident is not just simple price manipulation, but a fatal security flaw caused by the neutralization of the oracle's cryptographic signature verification system itself.

The stolen assets are worth approximately $9.05 million, primarily consisting of stablecoins like USDC and USDT, and wHBAR. Bonzo Lend is currently finalizing the extent of the damage and making various efforts to recover the assets.

Technical Deep Dive: The Risks of the Oracle Verifier Gap

The core of this attack lies in the so-called 'verifier gap.' Supra Oracle's verifier made an error by approving price update requests even in the absence of valid signatures. As a result, the price of SAUCE tokens, arbitrarily set by the attacker, was reflected directly on the Hedera mainnet.

• Occurrence of a logical flaw within Supra Oracle's signature verification logic
• Uncritical acceptance of invalid 'zero signature' data
• Absence of third-party data re-verification at the protocol security layer

The attacker used this vulnerability to inflate the value of 250 SAUCE to millions of dollars, using it as collateral to drain the protocol's liquidity. This case demonstrates how a minor signature verification error in an oracle service can lead to the bankruptcy of an entire DeFi protocol.

Meanwhile, the market price of the Hedera (HBAR) token remained relatively steady despite the incident. It dropped only slightly from $0.0772 on July 11, the day of the incident, to $0.0768 as of July 14, suggesting that trust in the network itself is being maintained.

Negotiations with White Hat 'Wallet B' and Recovery Status

The Bonzo Lend team is currently negotiating for the return of funds with a white hat responder known as 'Wallet B.' This responder preemptively secured and protected some funds during the attack process, and Bonzo believes their cooperation will be key to damage recovery.

Bonzo Finance Labs expressed gratitude for the white hat's good-faith response and stated that they will transparently disclose the return of funds as soon as it is completed. If these negotiations are concluded successfully, the actual losses for users may be lower than initial estimates.

Future Response Plan and Security Enhancement Measures

• Verification of the return of assets held by white hats and restoration of user accounts
• Comprehensive patching and re-auditing of Oracle security vulnerabilities
• Strengthening data reliability through the introduction of multiple Oracle feeds
• Publication of the final post-mortem report containing the cause of the incident and the response process

Bonzo Lend plans to maintain the suspension of lending market operations until the safety of the system is fully secured. Users should continue to monitor the compensation plan and market resumption schedule announced through official channels.