Bonzo Lend exploit: all 4,571 ETH went into Tornado Cash — most of it within a day

According to Bonzo’s post-mortem and press accounts, the price feed Bonzo used for the SAUCE token accepted an update carrying an empty signature. The attacker pushed the price up by twelve orders of magnitude, deposited 250 SAUCE and borrowed against it: 6.63 million USDC and about 34.5 million wrapped HBAR, about $9.05 million. Bonzo’s value locked fell 77% within hours; a white hat who took about $1 million during the incident returned it.

PeckShield and Specter flagged the Ethereum side the same day and named two wallets: 0xaf20D792A19fD42dCf697ceBa6100291D96dD93e and 0x9A4966152F6e10b33Cb7a37975e8619816d6a494. Everything below is those two wallets, read on 5 October 2026.

The main wallet did not exist until 22:15 UTC on 10 July, when it received 0.995 ETH from Tornado Cash’s 1 ETH pool. The first stolen money reached it at 00:57 on 11 July — under three hours later. The second wallet was created from the first at 01:04 with a 0.005 ETH transfer and served as a side entrance: 14.16 WBTC and about 115 ETH passed through it into the main wallet.

The attacker did not use one bridge. The money came in four ways over eleven hours:

Bitcoin over LayerZero. 92.64 WBTC arrived through the LayerZero WBTC adapter in 33 transfers of 1.4 to 5.8 WBTC, a few minutes apart, from 01:32 UTC on. All of it was sold for ether through the 0x settler — 3,133.6 ETH on 11 July and another 156.7 ETH on 14 July.

Ether from Arbitrum and Base. Between 07:12 and 07:21 the Relay bridge delivered 927.3 ETH in nine payments — eight of 99.73 ETH and one of 129.47. For the payments we looked up, Relay’s own records show the sender on the other side was the same address — 100 ETH on Arbitrum, 129.82 ETH on Base. So part of the Hedera money was first bridged to those networks, turned into ether there, and only then brought to Ethereum.

Across and Stargate. Another 133 ETH came through Across at 07:27–07:31, and 7 ETH through Stargate.

Stablecoins. 98,323 USDC and about 75,600 USDT arrived directly and were swapped for ether within hours.

Added up, 4,570.9 ETH came into the main wallet. The figures published on the day were lower because they were snapshots: the $5.25 million count was taken when the wallet held 2,360 ETH and WBTC was still arriving and being sold.

The first deposit into Tornado Cash went in at 11:20 UTC on 11 July, seven minutes after the last WBTC was sold. From there the wallet did nothing else: 45 deposits of 100 ETH, 6 of 10, 11 of 1 and one of 0.1 — 4,571.1 ETH in all. 4,405 ETH was in the mixer before the end of 11 July. The last 4.49 WBTC arrived from Hedera on 14 July; it was sold and the final 166.1 ETH followed the same morning.

On 5 October the main wallet holds 0.09 ETH and the second one nothing. Their histories are now crowded with look-alike addresses — 0xaf22…, 0xaf20…, 0x9A49… — and fake tokens named “ETH” and “USDT”, sent by strangers to trick anyone copying an address from the list. Those are not part of the trail.

On Ethereum, nothing: there is no parked balance to freeze or watch. Roughly $0.8 million of the reported loss never appeared on these two wallets; it was either lost to bridge and swap costs or is still on Hedera, which we did not read.

We have marked both wallets as hack-related in our database. You can check any address against this and our other cases on the address check page.

It names nobody and does not say who controls any address. The mechanism and the loss figure are Bonzo’s and the press’s account; the two Ethereum wallets were first named by PeckShield and Specter. Arrivals, routes and Tornado totals are ours, read from the chain on 5 October 2026. The dollar figure uses about $1,800 per ETH, the price implied by the reports of 11 July.