Bonzo Lend, a lending protocol on the Hedera network, lost approximately $9.05 million after an attacker exploited a verification flaw in a third-party Supra oracle contract on July 11. The attacker deposited 250 SAUCE tokens worth a few dollars as collateral, then submitted a manipulated price update that inflated the token’s HBAR-denominated value, borrowing 6.63 million USDC and 34.52 million wrapped HBAR worth roughly $9.05 million. A second wallet borrowed roughly $1 million more before returning the funds as a white-hat. Bonzo’s TVL plunged 77% in 24 hours, and over $5.25 million of the stolen funds was bridged to Ethereum via LayerZero.
Source: Read the original article
