News linked to both this project and an event.
Bonzo Finance, a lending protocol based on Hedera, suffered an oracle attack, resulting in a loss of approximately $9 million. The attacker exploited collateral whose SAUCE token price had been artificially inflated to borrow assets far exceeding their actual value from the protocol. According to a preliminary incident report released by Bonzo Finance, the attacker deposited only 250 SAUCE tokens, then submitted a single price update that artificially inflated the token's price by approximately 12 orders of magnitude. Subsequently, the address borrowed 6.63 million USDC and 34.5 million wrapped HBAR from the lending pool.This attack was not due to a vulnerability in Bonzo Finance's smart contracts or the underlying Hedera network itself, but rather stemmed from a flaw in the on-chain oracle verifier of the oracle service provider Supra. It erroneously accepted a SAUCE price data point where the signature had been zeroed out. Supra has since confirmed the issue and completed a fix.
: According to on-chain detective Specter's monitoring, the Hedera Network is suspected of being hacked. The attacker has bridged over $3.7 million from the Hedera Network to Ethereum via LayerZero. The stolen funds are currently being swapped from WBTC to ETH. The theft addresses include 0x9A4966152F6e10b33Cb7a37975e8619816d6a494 and 0xaf20D792A19fD42dCf697ceBa6100291D96dD93e.