Bonzo Finance lost approximately $9.05 million after an attacker exploited a verification flaw in a third-party Supra oracle contract on the Hedera network. The vulnerability reportedly allowed the attacker to borrow assets far beyond the collateral that had been deposited, bypassing the protocol’s intended lending limits.
The exploit originated from external oracle infrastructure rather than Bonzo Lend’s core lending contracts, highlighting the growing risks associated with third-party dependencies in DeFi.
LATEST: ???? Bonzo Lend lost $9.05M after an attacker exploited a verification flaw in a third-party Supra oracle contract to borrow far beyond their collateral on Hedera. pic.twitter.com/dusuSuzMjy
— CoinMarketCap (@CoinMarketCap) July 13, 2026
Intelligence Finding
The incident reinforces that oracle infrastructure remains one of DeFi’s largest attack surfaces. Even when a protocol’s core contracts are secure, vulnerabilities in external services can compromise lending markets and expose user funds. As DeFi protocols become increasingly interconnected, third-party security is becoming just as important as smart contract security.
