Hedera news

Hedera-based lending protocol Bonzo Lend has locked withdrawals after an oracle verifier accepted a proof containing a zeroed signature and public key, allowing a wallet to borrow $9.05 million against 250 SAUCE tokens worth only a few dollars. The exploit occurred when the wallet submitted a price update that inflated SAUCE's value by roughly 12 orders of magnitude, then borrowed 6.63 million USDC and 34.5 million wrapped HBAR. Supra's verifier failed to reject the zeroed inputs, as the pairing equation returned true when both the signature and public key were at the point at infinity. Bonzo's lending contracts followed their programmed rules using the manipulated price. A separate white-hat wallet borrowed about $1 million and intends to return the funds. Bonzo reported that Supra has fixed the verifier, but the lending pool remains closed as of July 13.

Bonzo Lend, a decentralized lending protocol on Hedera, lost approximately $9.05 million after an attacker exploited a vulnerability in a third-party Supra oracle verifier. The attacker submitted a manipulated price update for the SAUCE token, overstating its value by roughly 12 orders of magnitude, allowing them to borrow 6.63 million USDC and 34.5 million wrapped HBAR against a near-worthless deposit. The fake price update carried a cryptographic signature made entirely of zeros, which Supra's verifier mistakenly accepted due to a flaw in signature checking. Supra acknowledged the issue and deployed a fix. A second wallet borrowed about $1 million during the incident but voluntarily returned the funds. The protocol paused lending and its points program, while vaults, bridge, and staking products remained unaffected. This exploit adds to a record-breaking year for crypto exploits, with $972 million lost across 207 incidents in the first half of 2026. The attack highlights a trend of infrastructure failures and privileged-access weaknesses beyond core contract vulnerabilities.

Bonzo Lend, a decentralized lending protocol on the Hedera network, lost approximately $9.05 million after an attacker exploited a verification flaw in a third-party Supra oracle contract. The attacker deposited low-value SAUCE tokens and submitted a manipulated price update to inflate their value, then borrowed assets far exceeding their collateral. A second wallet borrowed roughly $1 million more during the exploit but later contacted Bonzo via Discord, identifying as a white-hat responder and indicating an intent to return the funds. Excluding that, total principal borrowed was about $10.06 million. Following the incident, Hedera's total value locked (TVL) dropped nearly 40% in 24 hours to $25.7 million, while Bonzo's TVL plummeted by 77%, according to DeFiLlama data.

Hedera-based lending protocol Bonzo Lend lost approximately $9 million after an attacker exploited a flaw in Supra's on-chain oracle verifier. The attacker deposited 250 SAUCE tokens, worth only a few dollars, then submitted a manipulated price that inflated the token's value by roughly 12 orders of magnitude, allowing them to borrow 6.63 million USDC and 34.5 million wrapped HBAR. The incident, which Bonzo attributed to a defect in Supra's oracle verifier that accepted a zeroed signature, underscores how oracle failures can drain liquidity from lending protocols. Supra acknowledged the issue and deployed a fix, while Bonzo stressed that its own contracts and Hedera's core network were not vulnerable. The exploit adds to a spate of DeFi hacks in 2026, with Q2 setting a record for incident count (83 exploits, ~$755 million stolen). DeFi TVL fell 39% from January to June, with repeated security incidents likely eroding user confidence.

Hedera (HBAR) suffered an exploit resulting in losses exceeding $5 million, according to blockchain researcher Specter. The attacker moved stolen assets to Ethereum via LayerZero, swapping Wrapped Bitcoin (WBTC) for ETH. Security firm PeckShield estimated the bridged amount at $5.25 million, with the attacker's wallet holding 2.36K ETH and 15.58 WBTC. The wallet was initially funded with 1 ETH through Tornado Cash.

Archax has launched real-time yield payments on the Hedera network, allowing interest from tokenized securities to be distributed continuously in USDC. The system enables cash flows to update automatically as tokens move between wallets, with yield following ownership in real time, moving beyond traditional periodic interest payments. The initiative builds on Archax's previous work, including Pool Tokens on Hedera, which bundle multiple tokenized assets. CEO Graham Rodford noted that tokenization is just the first step, and real-time cash flows can support yield streams and reduce inefficiencies. Archax, a UK-regulated digital asset exchange and custodian, hosts over $300 million in tokenized assets on Hedera. The development comes as financial institutions increasingly adopt yield-bearing tokenized assets, with tokenized money market funds growing rapidly. Binance Research reports a 589% increase in active tokenized RWA value since early 2025.

McLaren Racing has joined the Hedera Council as a governing member with equal voting rights, contributing to the enterprise blockchain network's software and services governance. The Formula 1 team, which won the last two team championships, aims to enhance fan engagement through this partnership. McLaren has launched free-to-mint digital collectibles on Hedera tied to specific races, targeting both motorsport fans new to Web3 and Hedera community members new to racing. The partnership includes McLaren's participation in HederaCon alongside the Miami Grand Prix.

Hedera's HBAR token fell below the neckline of a head‑and‑shoulders pattern on March 7, signaling a bearish technical breakdown, even as the network’s total value locked rose about 50% from $38.6 million to $60.4 million. Despite the price weakness, retail dip‑buyers remain active, shown by a rising Money Flow Index and continued exchange outflows of roughly $527 k. However, the Chaikin Money Flow has turned negative, indicating larger capital outflows. The breakdown targets about $0.079, an 15‑18% drop from current levels, while a recovery would need to clear $0.101 and ideally $0.106 to invalidate the pattern.

FedEx Corp. announced it has joined Hedera Council, adding a network node and governance role to the distributed ledger platform. The move aims to accelerate digital supply‑chain transformation, replacing paper‑based processes with trusted, verifiable data across partners. Hedera’s council already includes Google, IBM, Dell, LG, Deutsche Telekom and Ubisoft. FedEx will contribute logistics expertise, while Hedera offers an enterprise‑grade trust layer for global verification, supporting interoperable data sharing.

HBAR has slid about 40% since the Canary ETF launch, yet the fund failed to generate sustained inflows – it peaked at roughly $30 million in late‑October but now records only $875 k and flat net flows. Technical metrics, such as the Chaikin Money Flow slipping below zero, signal waning institutional interest and possible further outflows, leaving price trapped between $0.131 resistance and $0.113 support. Unless capital flows reverse, a recovery looks unlikely; a decisive move above $0.131 could lift sentiment, but a breakdown below $0.113 would target $0.104 and $0.096 as next supports.