SendTech Times
العربية
Fintech & Digital PaymentsNews|July 13, 2026, 08:27 AM
MARKET SIGNAL:

Bonzo Lend Pauses Hedera Pool After $9.05 Million Oracle Exploit

BySendTech Times Fintech DeskNewsroom-edited, source-reviewed coverage|Source: Bonzo Finance Labs
Newsroom brief

Bonzo Finance Labs said a third-party Supra oracle verification flaw let Wallet A borrow about $9.05 million from its Hedera lending pool after a manipulated SAUCE price update. The pool remains paused while reimbursement terms, withdrawal timing and final recovery accounting stay outside the public record.

Verified against source materialEdited by SendTech Times Fintech Desk
Bonzo Lend Pauses Hedera Pool After $9.05 Million Oracle Exploit
Image source: Bonzo Finance Labs

Bonzo Lend has paused its Hedera lending pool after an oracle-verification exploit let a wallet borrow assets far beyond the value of its posted SAUCE collateral.

Bonzo Finance Labs, writing in coordination with the Bonzo Finance Foundation, said the July 11, 2026 incident on Hedera mainnet traced to a third-party Supra oracle verification path, not to the lending-pool code.

Hedera Lending Pool Pauses After Oracle Exploit

The lending pool is paused while the lab and foundation decide when liquidity providers can withdraw and when normal operation can resume.

Bonzo Points is also paused, while Vaults, Bridge and single-sided $BONZO/$XBONZO staking were listed as unaffected.

Bonzo's incident report said Wallet A deposited 250 SAUCE before a manipulated price update was accepted by the third-party oracle's on-demand contract.

The abnormal update made the small SAUCE deposit appear far more valuable to the lending protocol than it was.

At 00:51 UTC, Wallet A submitted the manipulated price update for pair 425, according to the incident timeline.

The incident report said the account borrowed 6,634,528.202695 USDC and 34,518,389.36109841 WHBAR within seconds.

Zero-Signature Oracle Verification Drove The Borrowing

The oracle verifier accepted a proof with no valid signature.

The submitted update referenced committee ID 2 and carried a zeroed signature value of [0,0] where the committee's BLS signature should have appeared.

Hedera's pairing precompile, system contract 0.0.8, returned true because both the submitted signature point and the referenced committee public key were zero.

The missing validation step was rejection of zero, identity and off-subgroup inputs before a true pairing result was treated as a valid committee signature.

Supra acknowledged the issue and deployed a fix to the affected verifier contract on Hedera mainnet.

The incident report said the lending protocol read the recorded oracle value, computed collateral value and borrowing capacity from that value, and did not submit anything to the feed itself.

Wallet A Borrowed $9.05 Million In Principal

The official report said all listed figures used an HBAR reference price of $0.06998 and treated USDC as $1.00.

The official report said Wallet A's extracted principal was approximately $9.05 million, while total principal borrowed during the incident was approximately $10.06 million before recovery items.

A second account, Wallet B, borrowed roughly $1.0 million while the abnormal price remained active.

The team said Wallet B contacted it through Discord, identified itself as a white-hat responder and said it intended to return the funds, so those borrowings are being treated as a recovery matter rather than part of the headline loss estimate.

A reimbursement plan, final loss accounting, withdrawal timetable, conditions for lifting the lending-pool pause, recovered-asset totals and completed reconciliation of Wallet B's stated return remain outside the public record.

Share this article
inXf

Related articles

More
Circle OCC Approval Creates Federal Trust Bank Route For USDC Custody
Fintech & Digital Payments

Circle OCC Approval Creates Federal Trust Bank Route For USDC Custody

Final OCC approval for Circle National Trust creates a federally supervised custody route for USDC, but the bank opening date, first institutional customers and reserve-management migration timing remain outside the public record.

Keyper Raises $11 Million To Expand UAE Monthly Rent Payments
Fintech & Digital Payments

Keyper Raises $11 Million To Expand UAE Monthly Rent Payments

Keyper raised an $11 million Series A led by Speedinvest to expand monthly rent payments and landlord financing products in the UAE. The company said it has financed more than $44 million in rent value, while pricing, financing terms and named institutional landlord customers remain outside the public record.

Goldman Adds Prediction-Market Trades To Bank Compliance Lists
Fintech & Digital Payments

Goldman Adds Prediction-Market Trades To Bank Compliance Lists

Goldman Sachs has restricted some employee prediction-market trades, according to CNBC, while the outlet's 50-company survey found explicit policies at only three firms. A CFTC case against a Google employee gives the compliance issue a legal marker, with most company policy details still outside the public record.

Swift Lines Up 17 Banks For Tokenised Deposit Ledger Tests
Fintech & Digital Payments

Swift Lines Up 17 Banks For Tokenised Deposit Ledger Tests

Swift said 17 banks are preparing to test live transactions on a blockchain-based shared ledger for tokenised deposits. The system is meant to support round-the-clock cross-border payments, while final settlement remains tied to existing payment systems.

Sberbank Plans Crypto Wallet As Russia Sets September Digital-Asset Law
Fintech & Digital Payments

Sberbank Plans Crypto Wallet As Russia Sets September Digital-Asset Law

Sberbank plans to add a crypto wallet and digital depository to Sberbank Online and SberInvestments by December if Russia’s digital-asset bill takes effect as expected on Sept. 1. The plan follows years of central-bank resistance and leaves fees, eligible tokens and launch conditions outside the public record.

Taktile Raises $110 Million As Banks Test AI Agent Oversight
Fintech & Digital Payments

Taktile Raises $110 Million As Banks Test AI Agent Oversight

Taktile raised $110 million for financial-services AI agents, according to PYMNTS. Bank customers, valuation, benchmark methodology or regulator-reviewed deployment evidence remain outside the public record.

Keep Reading

More Stories

Latest
Meeza Delivers 4MW Qatar Hyperscaler Expansion Nine Months EarlyCloud & Data CentersJul 13, 2026Meeza Delivers 4MW Qatar Hyperscaler Expansion Nine Months EarlyMeeza completed a 4MW Qatar data-centre expansion for an unnamed global hyperscaler nine months ahead of schedule, Data Center Dynamics reported. The project follows a QAR 350 million ($96m) hosting agreement signed in July 2025 for more than a decade of capacity, but the customer remains undisclosed.FCC Router Ban Docket Adds Vantiva Approval And CTIA Waiver RequestTelco & ConnectivityJul 13, 2026FCC Router Ban Docket Adds Vantiva Approval And CTIA Waiver RequestLight Reading reported that the FCC router-ban docket now includes Vantiva’s conditional approval, new CTIA and WNC waiver petitions, and multiple approvals running into 2027 and 2028, while several requests remain pending.Micron Raises U.S. Fab Plan Above $250 Billion As New York Pour StartsChips & SemiconductorsJul 12, 2026Micron Raises U.S. Fab Plan Above $250 Billion As New York Pour StartsMicron said its planned U.S. fab and technology investment now exceeds $250 billion through 2035 and that the first concrete pour has started at its Clay, New York site, with customer orders and site-level production volumes still outside the public release.Qatar Weekly Property Deals Reach $155m As Doha Leads ActivityReal EstateJul 12, 2026Qatar Weekly Property Deals Reach $155m As Doha Leads ActivityEconomy Middle East cited Ministry of Justice data putting Qatar’s weekly real estate transactions at QAR565.3 million ($155 million), led by Doha and supported by residential-unit contracts.FAB And Mashreq Join Swift Tokenised Deposit Payment PilotFintech & Digital PaymentsJul 12, 2026FAB And Mashreq Join Swift Tokenised Deposit Payment PilotUnlock Blockchain reported that FAB and Mashreq are among 17 financial institutions preparing live Swift shared-ledger transactions for tokenised deposits, with transaction volumes, currency pairs and commercial timing still outside the public record.Meta Plans $9.17bn Alberta Data Centre With 1GW Power TargetCloud & Data CentersJul 12, 2026Meta Plans $9.17bn Alberta Data Centre With 1GW Power TargetA 1GW Meta data-centre plan in Sturgeon County carries CA$13 billion in expected investment, a Project Greenlight power component and no public first-service or grid-approval timetable.RBI Rules Keep ixigo Voice Payments Tied To Human AuthenticationFintech & Digital PaymentsJul 12, 2026RBI Rules Keep ixigo Voice Payments Tied To Human Authenticationixigo is reviewing voice payments for travel bookings, but RBI authentication rules still require a provable human authorisation record before the voice interface can move into payments.Ireland Data Centres Used 23 Percent Of Metered Electricity In 2025Cloud & Data CentersJul 12, 2026Ireland Data Centres Used 23 Percent Of Metered Electricity In 2025Central Statistics Office figures recorded Ireland data centres at 23 percent of metered electricity use in 2025, even as Dublin-area grid restrictions remained in place for most of the year.Indian Tech Stocks Split As MapmyIndia Rises And Ola Electric FallsCapital & PolicyJul 12, 2026Indian Tech Stocks Split As MapmyIndia Rises And Ola Electric FallsInc42's weekly table showed Indian new-age tech stocks splitting during the week, with 29 gainers and 27 decliners. MapmyIndia led gains, while Ola Electric fell after fresh vendor insolvency petitions.Crypto IPO Pipeline Slows As Capital Rotates Beyond Digital AssetsCapital & PolicyJul 12, 2026Crypto IPO Pipeline Slows As Capital Rotates Beyond Digital AssetsCrypto listing plans are slowing as investor attention moves beyond digital assets, according to CoinDesk. Delayed IPO candidates include Kraken parent Payward, Consensys, Ledger and Grayscale, while infrastructure providers still draw institutional interest.AIC Shows 32-Drive PCIe Gen6 JBOF Server For AI Cache WorkloadsChips & SemiconductorsJul 12, 2026AIC Shows 32-Drive PCIe Gen6 JBOF Server For AI Cache WorkloadsServeTheHome reported that AIC showed a 2U PCIe Gen6 JBOF server for AI cache workloads at Computex, with 32 E3 drive bays and Broadcom PCIe Gen6 switching but no public pricing or deployment list.Crusoe Adds Serverless Fine-Tuning To AI Infrastructure PlatformCloud & Data CentersJul 12, 2026Crusoe Adds Serverless Fine-Tuning To AI Infrastructure PlatformCrusoe added managed fine-tuning and inference services for open-weight models inside Intelligence Foundry. The launch moves its AI infrastructure pitch beyond rented GPU access, while prices, named customers and verified savings remain outside the public record.