Hackers stole $ 9 million from the Bonzo Lend protocol by manipulating the token price

The Bonzo Lend lending protocol was attacked, resulting in the attackers draining $ 9.05 million. Bonzo Finance Labs reported this in an incident report.

The hacker exploited a vulnerability in the pricing mechanism of the third-party Supra oracle contract and artificially inflated the price of the SAUCE token. With only 250 SAUCE tokens worth a few dollars, the attacker managed to borrow 6.63 million USDC stablecoins and over 34.5 million wrapped HBAR tokens worth $ 2.4 million from the protocol.

The incident was caused by an error in Supra’s signature verification process: the update contained a null signature instead of a valid one, and the oracle verifier approved a proof that should have been rejected. The protocol team has already deployed a patch to the relevant verifier contract on the Hedera mainnet.

Bonzo has suspended operations of the Bonzo Lend service and the accrual of Bonzo Points. According to the developers, the attack did not affect Bonzo Vaults, Bonzo Bridge, or BONZO staking—these services continue to operate. Bonzo Finance Labs and the Bonzo Finance Foundation are currently working to recover the stolen assets and develop a repayment plan for liquidity providers. The developers have not yet announced a date for the resumption of the lending pool.

One of the attackers reached out to the Bonzo team via Discord. He noted that he had borrowed $ 1 million at a time when the price of SAUCE was still anomalous, identified himself as a «white hat hacker,» and stated his intention to return the funds. In light of this, the developers have excluded this amount from the total losses and are continuing negotiations regarding the return of the assets.

In the wake of the incident, the HBAR price fell 9.39% over the week to $ 0.6 769, and the cryptocurrency’s market capitalization stands at $ 2.96 billion. HBAR’s daily trading volume fell by 51.29% to $ 39.2 million.

This is not the first high-profile hack in the sector in recent times. Earlier this month, hackers attacked the decentralized Edel Finance protocol and stole approximately $ 403,000, and a week later, unknown attackers carried out a flash loan attack against Summer Finance, from which they stole approximately $ 6 million.