{"id":10698,"date":"2026-07-13T05:13:38","date_gmt":"2026-07-13T05:13:38","guid":{"rendered":"https:\/\/cryptonews.uk.com\/?p=10698"},"modified":"2026-07-13T05:13:38","modified_gmt":"2026-07-13T05:13:38","slug":"bonzo-lend-loses-9m-in-oracle-exploit-as-fake-sauce-price-drains-protocol","status":"publish","type":"post","link":"https:\/\/cryptonews.uk.com\/?p=10698","title":{"rendered":"Bonzo Lend Loses $9M in Oracle Exploit as Fake SAUCE Price Drains Protocol"},"content":{"rendered":"

<\/p>\n

\n
\n
\n
    \n
  • An attacker borrowed about US$9.05 million (AU$13 million) from the Hedera lending protocol on July 11 after a price update carrying a zeroed signature passed Supra\u2019s third-party oracle verifier.<\/span><\/li>\n
  • The fake update inflated SAUCE\u2019s price by roughly twelve orders of magnitude; a second wallet that took about US$1 million (AU$1.44 million) identified itself as a white-hat and committed to returning the funds.<\/span><\/li>\n
  • Hedera said the incident was isolated to the external oracle verifier, and Supra acknowledged the flaw and deployed a fix on Hedera mainnet.<\/span><\/li>\n<\/ul>\n<\/div>\n<\/div>\n

    Bonzo Lend, a lending protocol on the Hedera network, lost about US$9.05 million (AU$13 million) on July 11 after an attacker pushed a fake price update through a flaw in Supra\u2019s third-party oracle verifier, inflating the price of the SAUCE token and borrowing against collateral worth a fraction of the loans taken.<\/p>\n

    The attack began at about 00:51 UTC, according to Bonzo\u2019s incident report. A wallet, which the team labels Wallet A, submitted a price update signed with a zeroed signature, which Supra\u2019s verifier accepted as valid.\u00a0<\/p>\n

    \n

    The update set SAUCE\u2019s price at one followed by thirty zeroes, against an actual market price of about 0.2 HBAR, inflating the token\u2019s value by roughly twelve orders of magnitude. With SAUCE collateral priced at that level, the wallet drained the protocol\u2019s lending pools.<\/p>\n

    A second wallet took about US$1 million (AU$1.44 million) using the same flaw. That wallet has since contacted the team, identified itself as a white-hat responder and committed to returning the funds, Bonzo said, so the team excludes it from the headline loss.<\/p>\n

    Related: DeFi Portfolio Tracker Zapper to Shut Down After Seven Years<\/strong><\/p>\n

    A Zeroed Signature Passed the Verifier<\/h2>\n

    Bonzo\u2019s report traces the failure to how Supra\u2019s verifier checked signatures. \u201cThe pairing precompile was asked whether a specific equation held, and it correctly answered yes. Supra\u2019s verifier then treated that \u2018yes\u2019 as proof of a valid committee signature, which it never was,\u201d the report states.\u00a0<\/p>\n

    The team stressed that its own contracts priced collateral and computed borrowing capacity exactly as coded: \u201cAt no point did Bonzo Lend\u2019s contracts malfunction.\u201d<\/p>\n

    Hedera backed that account, stating the failure occurred upstream in the oracle layer and that the network\u2019s consensus and core services were not compromised. Supra acknowledged the verification exploit and deployed a fix to the affected contract on Hedera mainnet, and is working with security researchers to analyse the attack.<\/p>\n

    Bonzo paused its Lend and Points products after the exploit, while its Vaults, Bridge and staking products continue operating. Total value locked in the protocol fell from about US$14.3 million (AU$20.6 million) on July 10 to about US$3.2 million (AU$4.6 million) by July 12, a drop of roughly 78 per cent, according to DefiLlama data.<\/p>\n

    The team said it is coordinating with the white-hat responder on the return of funds and working out conditions for lifting the pause and reopening withdrawals for liquidity providers.<\/p>\n

    Read more: Zcash Jumps 12% as Developers Near Proof Against Hidden Counterfeit Bug<\/strong><\/p>\n<\/p><\/div>\n

    Hedera,Security#Bonzo #Lend #Loses #Oracle #Exploit #Fake #SAUCE #Price #Drains #Protocol1783919618<\/p>\n","protected":false},"excerpt":{"rendered":"

    An attacker borrowed about US$9.05 million (AU$13 million) from the Hedera lending protocol on July 11 after a price update carrying a zeroed signature passed Supra\u2019s third-party oracle verifier. The fake update inflated SAUCE\u2019s price by roughly twelve orders of magnitude; a second wallet that took about US$1 million (AU$1.44 million) identified itself as a<\/p>\n","protected":false},"author":1,"featured_media":10699,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[7],"tags":[5445,4858,664,2746,5446,1995,5447,49,131,5448],"class_list":["post-10698","post","type-post","status-publish","format-standard","has-post-thumbnail","category-bitcoin","tag-bonzo","tag-drains","tag-exploit","tag-fake","tag-lend","tag-loses","tag-oracle","tag-price","tag-protocol","tag-sauce"],"yoast_head":"\nBonzo Lend Loses $9M in Oracle Exploit as Fake SAUCE Price Drains Protocol - Crypto News: Latest Cryptocurrency News and Analysis<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/cryptonews.uk.com\/?p=10698\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Bonzo Lend Loses $9M in Oracle Exploit as Fake SAUCE Price Drains Protocol\" \/>\n<meta property=\"og:description\" content=\"An attacker borrowed about US$9.05 million (AU$13 million) from the Hedera lending protocol on July 11 after a price update carrying a zeroed signature passed Supra\u2019s third-party oracle verifier. The fake update inflated SAUCE\u2019s price by roughly twelve orders of magnitude; a second wallet that took about US$1 million (AU$1.44 million) identified itself as a\" \/>\n<meta property=\"og:url\" content=\"https:\/\/cryptonews.uk.com\/?p=10698\" \/>\n<meta property=\"og:site_name\" content=\"Crypto News: Latest Cryptocurrency News and Analysis\" \/>\n<meta property=\"article:published_time\" content=\"2026-07-13T05:13:38+00:00\" \/>\n<meta name=\"author\" content=\"\u884c\u653f\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"\u884c\u653f\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=10698\",\"url\":\"https:\/\/cryptonews.uk.com\/?p=10698\",\"name\":\"Bonzo Lend Loses $9M in Oracle Exploit as Fake SAUCE Price Drains Protocol - Crypto News: Latest Cryptocurrency News and Analysis\",\"isPartOf\":{\"@id\":\"https:\/\/cryptonews.uk.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=10698#primaryimage\"},\"image\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=10698#primaryimage\"},\"thumbnailUrl\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/07\/98402.jpeg\",\"datePublished\":\"2026-07-13T05:13:38+00:00\",\"author\":{\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf\"},\"breadcrumb\":{\"@id\":\"https:\/\/cryptonews.uk.com\/?p=10698#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/cryptonews.uk.com\/?p=10698\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=10698#primaryimage\",\"url\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/07\/98402.jpeg\",\"contentUrl\":\"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/07\/98402.jpeg\",\"width\":1200,\"height\":675},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/cryptonews.uk.com\/?p=10698#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/cryptonews.uk.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Bonzo Lend Loses $9M in Oracle Exploit as Fake SAUCE Price Drains Protocol\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/cryptonews.uk.com\/#website\",\"url\":\"https:\/\/cryptonews.uk.com\/\",\"name\":\"Crypto News: Latest Cryptocurrency News and Analysis\",\"description\":\"Latest Crypto & Bitcoin News\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/cryptonews.uk.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf\",\"name\":\"\u884c\u653f\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cryptonews.uk.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g\",\"caption\":\"\u884c\u653f\"},\"sameAs\":[\"http:\/\/demo3.aiwalls.com\/coinbase\"],\"url\":\"https:\/\/cryptonews.uk.com\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Bonzo Lend Loses $9M in Oracle Exploit as Fake SAUCE Price Drains Protocol - Crypto News: Latest Cryptocurrency News and Analysis","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/cryptonews.uk.com\/?p=10698","og_locale":"en_US","og_type":"article","og_title":"Bonzo Lend Loses $9M in Oracle Exploit as Fake SAUCE Price Drains Protocol","og_description":"An attacker borrowed about US$9.05 million (AU$13 million) from the Hedera lending protocol on July 11 after a price update carrying a zeroed signature passed Supra\u2019s third-party oracle verifier. The fake update inflated SAUCE\u2019s price by roughly twelve orders of magnitude; a second wallet that took about US$1 million (AU$1.44 million) identified itself as a","og_url":"https:\/\/cryptonews.uk.com\/?p=10698","og_site_name":"Crypto News: Latest Cryptocurrency News and Analysis","article_published_time":"2026-07-13T05:13:38+00:00","author":"\u884c\u653f","twitter_card":"summary_large_image","twitter_misc":{"Written by":"\u884c\u653f","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/cryptonews.uk.com\/?p=10698","url":"https:\/\/cryptonews.uk.com\/?p=10698","name":"Bonzo Lend Loses $9M in Oracle Exploit as Fake SAUCE Price Drains Protocol - Crypto News: Latest Cryptocurrency News and Analysis","isPartOf":{"@id":"https:\/\/cryptonews.uk.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/cryptonews.uk.com\/?p=10698#primaryimage"},"image":{"@id":"https:\/\/cryptonews.uk.com\/?p=10698#primaryimage"},"thumbnailUrl":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/07\/98402.jpeg","datePublished":"2026-07-13T05:13:38+00:00","author":{"@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf"},"breadcrumb":{"@id":"https:\/\/cryptonews.uk.com\/?p=10698#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/cryptonews.uk.com\/?p=10698"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptonews.uk.com\/?p=10698#primaryimage","url":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/07\/98402.jpeg","contentUrl":"https:\/\/cryptonews.uk.com\/wp-content\/uploads\/2026\/07\/98402.jpeg","width":1200,"height":675},{"@type":"BreadcrumbList","@id":"https:\/\/cryptonews.uk.com\/?p=10698#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/cryptonews.uk.com\/"},{"@type":"ListItem","position":2,"name":"Bonzo Lend Loses $9M in Oracle Exploit as Fake SAUCE Price Drains Protocol"}]},{"@type":"WebSite","@id":"https:\/\/cryptonews.uk.com\/#website","url":"https:\/\/cryptonews.uk.com\/","name":"Crypto News: Latest Cryptocurrency News and Analysis","description":"Latest Crypto & Bitcoin News","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/cryptonews.uk.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/822778c5844e0d16d43dce6630f4f1bf","name":"\u884c\u653f","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptonews.uk.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/e4c2d23409b09e004cef3facbe677e95c5401f9e29680f3a311e0130c5748089?s=96&d=mm&r=g","caption":"\u884c\u653f"},"sameAs":["http:\/\/demo3.aiwalls.com\/coinbase"],"url":"https:\/\/cryptonews.uk.com\/?author=1"}]}},"_links":{"self":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts\/10698","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=10698"}],"version-history":[{"count":0,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/posts\/10698\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=\/wp\/v2\/media\/10699"}],"wp:attachment":[{"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=10698"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=10698"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cryptonews.uk.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=10698"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}