A few dollars’ worth of Sauce was fed to an oracle and turned into a sky-high price—$9 million just vanished like that. DeFi’s security lessons can never be finished.

Bbijie News reported that the Hedera-based lending protocol Bonzo Lend lost about $9 million due to an oracle vulnerability. The attacker manipulated the price of Sauce used as collateral, borrowing more than $9 million in assets. In its initial incident report, Bonzo Lend said the attacker first deposited 250 Sauce tokens (worth only a few dollars), then submitted a price update that boosted the token’s value by about 12 orders of magnitude. The wallet then borrowed 6.63 million USDC and 34.5 million Wrapped HBAR from the lending pool. The incident highlights how an oracle malfunction can turn low-value collateral into a tool for extracting large amounts of liquidity from lending protocols. Bonzo Lend noted that the incident was not a vulnerability in its contract or in Hedera’s core network.