Bonzo Lend Review 2026: Hedera Lending After the Oracle Exploit

Bonzo Lend is the lending and borrowing market of Bonzo Finance, which describes itself as the liquidity layer of Hedera. The protocol is open source and non-custodial, and it is modeled on Aave. Users can supply supported assets to earn yield or borrow against collateral, and the project offers related products including automated vaults, a points program, staking for its BONZO token and a set of NFT collectibles.

The project launched on Hedera and was listed on DefiLlama in October 2024 in the lending category. At the time of the listing it was described as the largest lending protocol on Hedera, and a February 2025 announcement put its TVL above $35 million. The supported asset list includes HBAR, USDC, SAUCE and WETH, among others, bridged through Stargate in some cases.

The protocol's record changed in July 2026. A third-party research write-up says an attacker drained roughly $9.05M from Bonzo Lend through an oracle attack on July 11, 2026. A later statement from Bonzo Finance Labs, reported in a Binance Square post, said the incident affected Bonzo Lend. DefiLlama now shows no TVL and a 100% seven-day drop. The project does not establish whether the protocol has been wound down or is operating normally, so the status is recorded as unknown.

Bonzo Lend follows the model used by Aave. Users deposit a supported asset into a shared pool, and the protocol issues a receipt token that represents that deposit and grows in value as interest accrues. Borrowers can take out loans in other supported assets, provided their deposited collateral is worth enough to cover the loan under the protocol's rules.

The protocol needs accurate prices to know what collateral is worth. Those prices come from oracles, which feed market data into the contracts. If a price feed is wrong or manipulated, the protocol can misjudge positions, allowing borrows that should not be possible or liquidations that should not happen. The reported July 2026 incident was an oracle attack of this kind.

If a borrower's collateral value falls below the required threshold, the position can be liquidated by a third party who repays part of the debt in exchange for collateral at a discount. The project documents liquidation bots for this purpose. Bonzo Lend is described as non-custodial, which means the protocol's smart contracts hold the funds rather than a company, so the security of those contracts and their price inputs is the central question for users.

The project does not publish a full fee schedule for supplying or borrowing on Bonzo Lend. The project's documentation index lists a borrow fees and revenue page, and the Bonzo Points terms are linked from the homepage, so those are the places to check current costs. Transaction costs on Hedera are paid in HBAR and are separate from any protocol fee.

Audit coverage: The homepage says Halborn performed comprehensive audits of the protocol contracts, the incentives module and single-sided staking, and that secondary audits were still underway. DefiLlama lists two audits. The project does not give audit dates, scope beyond these modules, or whether the audit findings were fixed.

Incident: A third-party research write-up reports that on July 11, 2026 an attacker drained roughly $9.05M from Bonzo Lend through an oracle attack. A statement reported from the project's X account in July 2026 said the incident affected Bonzo Lend. The project does not include a post-mortem, a recovery plan or a statement on reimbursement, so these are not published in the material reviewed.

Custody and counterparty risk: Because the protocol is non-custodial, users hold their own keys and deposit into smart contracts. There is no company holding funds on their behalf, so a contract bug, a price feed failure or a governance decision can affect deposits directly. The project does not state whether insurance or a reserve fund exists.

Regulatory status: the project does not state a licence or regulatory registration. Lending in crypto assets may be treated differently depending on where you live, so check the rules that apply to you before using the protocol. Only use money you can afford to lose.

Bonzo Lend suits experienced DeFi users who already understand lending markets, liquidation risk and oracle dependence, and who want to lend or borrow HBAR-based assets on Hedera. It is not a good first product for someone new to crypto, and it is a poor fit for anyone who needs a clear, current record of security and fees before committing money.