Bonzo Lend Exploited for $9.05 Million via Oracle Vulnerability
Bonzo Lend experienced a significant exploit resulting in a loss of $9.05 million. The attack involved a manipulated price from a third-party oracle, allowing for large asset borrowing with little collateral.
Our full investigation: Bonzo Lend exploit: all 4,571 ETH went into Tornado Cash — most of it within a day
The exploit occurred on July 11, 2026, when an attacker took advantage of a vulnerability in the Supra oracle used by Bonzo Lend. By submitting a manipulated SAUCE price, the attacker was able to borrow approximately $9.05 million in assets with minimal collateral.
Following the exploit, the borrowed funds were swapped on SaucerSwap and bridged to Ethereum using LayerZero, with over $5 million tracked on-chain. In response to the abnormal activity, Bonzo Lend paused the protocol to mitigate further losses.
Addresses in this incident
| Address | Chain | Role | Check |
|---|---|---|---|
| 0xaf20d792a19fd42dcf697ceba6100291d96dd93e | ETH | mentioned in coverage | Check live |
| 0x9a4966152f6e10b33cb7a37975e8619816d6a494 | ETH | mentioned in coverage | Check live |
Roles are attributed to the source that stated them. Addresses without an attributed role are listed because coverage mentioned them, not because we assign them a part in the incident.