A Zero Signature Was Enough to Drain $9 Million From Bonzo Lend

By Isaac • July 11, 2026 7:49 pm •

A cryptographic signature made entirely of zeros should be the easiest possible input to reject.

On Hedera, it was enough to open a path into Bonzo Lend and turn a deposit worth a few dollars into roughly $9.05 million of borrowed assets.

The strangest part is that the lending protocol appears to have performed its own calculations correctly. It trusted a price that had already passed an upstream oracle check, and that check was where the protection failed.

Bonzo Finance Labs says in its preliminary incident report that Wallet A deposited 250 SAUCE, then submitted a manipulated SAUCE price to Supra’s on-demand oracle contract shortly after midnight UTC on July 11.

SAUCE was trading near 0.2