QuantorityBonzo Lending Protocol Drained in $9M Oracle Exploit on Hedera
A vulnerability in a third-party oracle allowed attackers to steal $9 million from the Hedera-based lending platform.
An attacker successfully drained approximately $9.05 million from Bonzo Lend, a lending protocol operating on the Hedera network, according to CoinDesk. The exploit targeted a vulnerability within a Supra oracle contract, a third-party component responsible for feeding price data into the platform.
The incident wiped out roughly 77% of the protocol's total value locked, marking a significant loss for users and the platform. The vulnerability centered on a verification flaw in the oracle mechanism, which allowed the attacker to manipulate data feeds feeding into Bonzo's smart contracts.
Oracle exploits remain a persistent security challenge in decentralized finance. These mechanisms serve as critical bridges between on-chain protocols and off-chain data sources, but design flaws or implementation gaps can expose platforms to manipulation attacks. The Bonzo incident underscores the risks that arise when protocols integrate third-party oracle services without adequate safeguards.
The timing of this exploit adds to a broader pattern of security incidents affecting projects built on emerging blockchain networks. While Hedera has positioned itself as an alternative to more established chains, the platform continues to face scrutiny around the robustness of protocols and their external dependencies.
For full details on the incident and ongoing investigation, see the original report at CoinDesk.
*Source: [CoinDesk](https://www.coindesk.com/web3/2026/07/11/lending-protocol-bonzo-loses-77-of-value-locked-as-usd9-million-oracle-exploit-rattles-hedera). Summary by Quantority.*
Funding-spike and liquidation-cascade alerts the moment they fire, plus unlimited history and a REST API.
See what's in Pro→How to read this
| Funding APR | Annualized, OI-weighted funding. Positive = longs pay shorts (crowded longs). |
| Percentile 90d | Where current funding sits within the coin's own last 90 days (0–100). |
| Open interest | Total USD value of outstanding perpetual contracts. |
| OI change 24h / 7d | How fast leverage is entering (+) or unwinding (−) over the period. |
| Liquidation skew | Imbalance of forced closures (−1…1): + = more longs liquidated, − = more shorts. |
| Leverage risk | 0–100 composite of funding extremity, OI momentum, liquidations and volatility. |
Read next
Hedera lending protocol Bonzo Lend loses $9M in price manipulation exploit
A vulnerability involving price data acceptance on Hedera's Bonzo Lend resulted in significant fund extraction, with a second operator claiming white hat status.
BTC
Corporate Bitcoin Holder Liquidates $87M Position
A company has sold a substantial amount of bitcoin, adding to recent divestments by miners and other institutional holders.
XRP
Ripple CTO Emeritus Says XRP Sales Harm Only Ripple
David Schwartz reiterates his view that Ripple's token sales do not negatively affect individual XRP holders.
Diego covers crypto derivatives markets for Quantority, reporting on liquidation cascades, exchange volume shifts and funding-rate moves. He writes descriptively and avoids price predictions.
Stretched markets, building leverage and the research worth reading — one short email.
Every figure here is read directly from Quantority's cross-exchange data. This is descriptive market analysis — a read on positioning, not a forecast, and not financial advice.