Hedera Lending Protocol Bonzo Loses 77% of TVL in $9M Oracle Attack
An oracle exploit drained roughly $9 million from Bonzo Finance, wiping out most of the Hedera-based lending protocol's locked value.
A sharp oracle exploit has struck Bonzo Finance, a lending protocol built on the Hedera network, erasing approximately 77% of its total value locked and exposing an estimated $9 million in losses. The attack follows a pattern increasingly familiar in decentralized finance: manipulating the price feeds that smart contracts rely on to determine asset valuations, then extracting funds before the distortion is corrected.
Oracle vulnerabilities remain one of DeFi's most persistent structural weaknesses. Unlike traditional financial systems where price data flows through regulated, redundant channels, on-chain lending protocols must trust external price-reporting mechanisms — and those mechanisms, when poorly secured or insufficiently decentralized, become attractive attack surfaces. When a price feed can be momentarily skewed, a sophisticated actor can borrow far more than their collateral is worth, then disappear before the protocol can respond.
Read more Carl Icahn's 2015 Broadside Against BlackRock and Larry Fink Explained →
The incident is a meaningful setback for Hedera's DeFi ecosystem, which has positioned itself as a more enterprise-friendly and energy-efficient alternative to Ethereum. Bonzo Finance was among the more prominent native lending venues on the network, and a loss of this scale will likely suppress user confidence and liquidity migration onto the chain in the near term. Recovery will depend heavily on how the protocol's team responds — whether through compensation mechanisms, audits, or architectural redesigns of its price-feed infrastructure.
For the broader DeFi sector, the Bonzo exploit reinforces a sobering reality: protocol security is only as strong as its weakest data input. As total value locked across DeFi continues to grow, oracle hardening — through time-weighted average prices, multiple independent feeds, and circuit breakers — is no longer optional engineering. It is table stakes for any protocol seeking durable user trust.
Continue reading at CoinDesk.
