Oracle signature verification bug halts Bonzo Lend after ~$9M loan

| cryptoslate.com
Hedera DeFi lender Bonzo Lend has paused withdrawals after an oracle signature verification flaw in Supra’s Hedera oracle verifier. A malicious “Wallet A” submitted a manipulated SAUCE/wHBAR on-demand price update where the oracle signature fields were zeroed. The verifier incorrectly accepted this input due to weak rejection of zero/identity public keys, triggering a leveraged mint-and-borrow exploit. Around 00:51 UTC, Wallet A deposited 250 SAUCE and then borrowed 6.63M USDC and 34.5M wrapped HBAR. Based on Bonzo’s reference pricing, the extracted principal was estimated at about $9.05M. Liquidity providers were unable to withdraw while Bonzo and affected markets remained under maintenance. A second “Wallet B” reportedly borrowed about $1M and contacted Bonzo as a white-hat responder, claiming funds would be returned; some recovery was counted, but final totals are still unclear. Supra says it has patched the verifier, but timelines for reopening withdrawals and resolving reimbursement/recovery terms were still pending as of July 13. For traders, this oracle signature bug is a reminder that oracle signature verification failures can rapidly lock TVL, tighten credit conditions, and raise counterparty risk across Hedera lending venues. Monitor HBAR liquidity/borrow rates and any protocol-specific risk alerts closely.
Bearish
The incident is tightly linked to Hedera lending mechanics: a failed oracle signature verification quickly produced large USDC and wrapped HBAR borrow positions, then forced Bonzo to pause withdrawals and keep liquidity constrained. In the short term, this typically pressures sentiment toward Hedera lending risk (higher perceived smart-contract/oracle risk), can reduce HBAR usable liquidity, and may widen borrow rates due to paused markets and delayed capital recovery. In the longer term, even though Supra claims a verifier patch, unresolved recovery/reimbursement details and prolonged maintenance can keep conservative lenders on the sidelines. That creates a headwind for HBAR and similar DeFi collateral demand until audits/incident reports and withdrawal resumption restore confidence. While broader market contagion to BTC/ETH is not implied here, the direct effect on the Hedera lending vertical is likely negative enough to be categorized as bearish.