Bonzo Lend, a decentralized lending protocol on the Hedera network, lost approximately 9.05 million dollars after an attacker exploited a flaw in a third-party Supra oracle contract.
The attacker deposited 250 low-value SAUCE tokens and submitted a manipulated price update to inflate their value. This allowed the account to borrow 6.63 million USDC and 34.52 million wrapped HBAR, valued at roughly 9.05 million dollars based on an HBAR price of 0.06998 dollars.
A second wallet borrowed about 1 million dollars in additional assets during the incident. That wallet later contacted Bonzo via Discord, identified itself as a white-hat responder, and indicated plans to return the funds.
Hedera's total value locked dropped nearly 40 percent in the following 24 hours to 25.7 million dollars. Bonzo Lend's TVL fell 77 percent over the same period.
