Blockchain network Hedera Hashgraph, commonly known as Hedera, appeared to be facing a major exploit on Saturday after millions of dollars were moved from the network to Ethereum.
But an address match found by The Coinformer indicates the incident was tied to a $9 million attack on Hedera-based lending protocol Bonzo Finance rather than a confirmed breach of Hedera itself.
Specter first raised the alarm in an X post on Saturday, July 11, saying an attacker had already moved more than $3.7 million from Hedera to Ethereum through LayerZero, a cross-chain bridge used to transfer crypto between different blockchains.
The investigator said the funds included Wrapped Bitcoin that was being exchanged for ETH after reaching Ethereum.
Specter later said more than $4 million had been moved, followed by estimates above $5 million and then $6 million.
Specter linked two Ethereum addresses that the investigator said were receiving and exchanging the funds.
Analysts at blockchain forensic firm PeckShield noted in an X post that prior to the attack, the hacker pre-funded its crypto wallet with 1 ETH via crypto mixer Tornado Cash.
Specter's X post / Bonzo Finance's post-mortem report. Source: X, Bonzo Finance
- The Coinformer found that one of the addresses flagged by Specter, 0x9A4966152F6e10b33Cb7a37975e8619816d6a494, was the same wallet identified by Bonzo Finance as the primary attacker in its post-mortem report.
A few hours after the news broke, the Hedera team wrote in an X post that they're "aware of the incident affecting Bonzo Lend, an independently operated DeFi application built on Hedera."
Hedera
Bonzo Finance said in a post-mortem report on July 11 that an attacker exploited a flaw in price oracle provider Supra Labs, which supplies market prices to decentralized applications on Hedera.
- By manipulating the reported price of SAUCE, the governance token of SaucerSwap, the attacker was able to borrow about $9 million from Bonzo Lend using only a small amount of collateral.
- As of press time, Supra Labs made no public comments on the matter.
- The BONZO token has fallen about 30% on the day, per data from SaucerSwap.
Commenting on the incident, SaucerSwap said in an X post on July 11 that "no SaucerSwap V1/V2 exploit has been identified. SaucerSwap remains operational. We're monitoring closely and supporting the ecosystem response."
Hedera previously suffered a confirmed exploit in March 2023, when an attacker used a flaw in Hedera's smart-contract service to steal tokens from accounts connected to several decentralized exchanges.
- There is currently no evidence that the latest suspected attack used the same weakness.
Update July 11, 11:03 am UTC. Added context about the incident around oracle provider Supra and lending protocol Bonzo Finance.
Update July 11, 11:26 am UTC. Updated the title and lead to reflect that the suspected Hedera hack was tied to the Bonzo Finance oracle exploit.
Update July 11, 1:47 pm UTC. Added comments from SaucerSwap.
Update July 11, 2:05 pm UTC. Added comments from Hedera.