The Next Generation of DeFi Hacks Won’t Target Smart Contracts

Bonzo Lend’s smart contracts passed their audits. Hedera’s network operated exactly as designed. Yet it still lost $9.05 million in under an hour.

The culprit wasn’t faulty code or a network vulnerability; it was a third-party Oracle infrastructure component that accepted an invalid price signature. It basically allowed an attacker to transform a few dollars of collateral into millions in borrowed assets.

The incident actually provides hackers with a new penetration method, consumers with a new reason not to trust blockchain, and security analysts with a new midnight project. External dependencies are now undermining the security model that once conquered smart contract exploits.

Oracle Security Is Rewriting the Rules of DeFi

The data tells a striking story. Flash-loan oracle manipulations and reentrancy attacks have collapsed from roughly 19% of DeFi losses in 2022 to under 1% in 2025, according to Immunefi’s six-year vulnerability dataset. Overall DeFi exploit losses fell from $2.62 billion in 2022 to $534 million in 2024.

Protocol teams invested heavily in TWAP price feeds, circuit breakers, reentrancy guards, and battle-tested oracle integrations. Smart contract security matured.

But, just as analysts improve, hackers improve too. In 2026, security incidents jumped 50% by count, and Q2 alone saw 83 exploits draining approximately $755 million. The difference: these attacks increasingly target infrastructure layers rather than protocol logic. Cross-chain bridges accounted for $351 million in losses. DeFi oracle security failures, once a tactical vulnerability, now represent a systemic architectural weakness.

RELATED: Why DeFi Feels Safe—Until You Discover Its Liquidity Web

The Bonzo Exploit Changed More Than One Protocol

Modern lending protocol security depends on accurate collateral valuation. A protocol needs to know if a user’s collateral worth is enough to cover their borrowing. That price data comes from oracles, off-chain systems that aggregate market information, sign it cryptographically, and deliver it on-chain.

The challenge is trust delegation. When Bonzo integrated Supra’s oracle, it inherited Supra’s security assumptions. The protocol’s own contracts could be flawless, but if the oracle’s verification logic failed, the entire system collapsed. A prime example is how Supra’s verifier accepted a zeroed BLS signature for the SAUCE token.

Supra’s verifier should have rejected any price update lacking a valid cryptographic signature. Instead, a flaw in Hedera’s pairing precompile (contract 0.0.8) returned true for the trivial identity case where both the signature and committee key were zero. The attacker didn’t forge anything; they simply submitted zeros, and the system accepted a SAUCE price inflated by twelve orders of magnitude.

RELATED: From WhatsApp Breaches to Blockchain Security: The Web3 Messaging Solution

The exploit’s efficiency was brutal. They simply deposit 250 SAUCE tokens (real value $50), borrow $6.63 million USDC and 34.52 million wHBAR, bridge more than $5.25 million to Ethereum via LayerZero, and swap WBTC for ETH.

Protocol paused 50 minutes after the initial deposit. By then, Bonzo’s TVL had fallen 77%.

Why Price Feeds Have Become High-Value Targets

Oracle-related failures have drained hundreds of millions across multiple protocols:

Mango Markets (October 2022)

$116 million lost when an attacker used cross-market self-trading to pump MNGO’s price by 2,300%, then borrowed against the inflated collateral. Here’s the kicker: Mango’s oracles worked correctly; they faithfully reported the manipulated market price. The failure was trusting thin-liquidity price feeds without circuit breakers or trade surveillance.

Venus Protocol (March 2026)

$2.15 million in bad debt after an attacker accumulated 84% of THE token supply over nine months, bypassed the supply cap via a donation attack, and sustained a TWAP-inflated price through a borrow-buy feedback loop.

A Code4rena audit had flagged the donation vulnerability with a proof-of-concept showing how 7,500 USDT of collateral could generate 21,075 USDT in negative debt. The Venus team dismissed the finding.

YieldBlox (February 2026)

$10 million lost to collateral-pricing manipulation on Stellar, following an almost identical pattern.

RELATED: Blockchain as a Service Explained: When It Makes Sense (And When to Walk Away)

Although it didn’t make headlines, Oracle infrastructure has become the single point of failure that bypassed otherwise secure lending logic.

Not All Oracle Infrastructure Carries the Same Risk

DeFi oracle security architecture varies widely, and those differences carry systemic implications:

Chainlink 

Its push model and decentralized oracle networks secure approximately 70% of all oracle-dependent value across 2,400+ projects. Its strength is decentralization. Multiple independent node operators aggregate data and stake collateral.

Its weakness is concentration risk. As Mitchell Amador, Immunefi’s head of security, warned:

“A failure in a single widely used provider could trigger cascading disruptions across multiple platforms at once.”

Pyth Network 

Its pull and on-demand model offers ultra-low latency by letting protocols pull signed prices when needed rather than waiting for scheduled pushes. First-party institutional data providers improve accuracy, but the model shifts verification responsibility to the consuming contract—precisely where Bonzo failed.

RedStone 

Its hybrid push and pull model became the fastest-growing oracle in 2025–2026, expanding across 60+ chains while claiming zero major incidents. Its modular architecture lets protocols choose verification strictness, but that flexibility also means integration quality varies.

Supra 

Its pull model and BLS signatures were designed for cross-chain efficiency, using BLS aggregation to compress committee signatures. The Bonzo exploit exposed how clever cryptographic optimizations introduce novel verification edge cases that standard EVM security assumptions don’t cover.

The Security Economics Problem

Protocol teams routinely spend $50,000–$200,000 on smart contract audits. Many run bug bounties exceeding $1 million for critical vulnerabilities in their code. Yet oracle infrastructure audits, runtime monitoring, and fallback redundancy often receive far less investment.

The protocol’s attack surface extends across every dependency, oracle provider, bridge, relayer, and keeper network, but security budgets concentrate on the narrowest layer.

Venus Protocol illustrates the cost. Olympix’s audit explicitly demonstrated the donation attack vector. The team chose not to resolve it. The exploit occurred exactly as predicted, and response prioritization ultimately caused the loss.

What Every Protocol Should Learn From Recent Exploits

So far, we can see that lending protocol security can no longer end at the protocol boundary.

Multi-oracle redundancy should be standard. Protocols can compare Chainlink, Pyth, and RedStone feeds, rejecting updates that deviate beyond tolerance thresholds. Yes, this approach increases gas costs and complexity, but a $9 million exploit is costlier.

Anomaly detection needs to move from post-mortem analysis to real-time circuit breakers. Weilin Li, an on-chain researcher, built an automated model that detected Venus Protocol’s March 2026 exploit in real time by flagging the spread between the CEX’s and DEX’s prices.

His 2023 academic paper had anticipated the exact attack pattern. Lending protocol infrastructure should incorporate that capability, rather than leaving it to external researchers.

RELATED: Decentralized Apps: Your secret to digital sovereignty now

Infrastructure audits deserve equal rigor. If a protocol delegates collateral valuation to an oracle verifier, that verifier’s signature-checking logic, edge-case handling, and cryptographic implementation must undergo the same scrutiny as the protocol’s own liquidation engine.

Operational trade-offs must be explicit. Low-latency pull oracles improve user experience but increase verification criticality. Push oracles are more deterministic but costlier and slower. Builders should treat oracle selection as a core security decision, not a convenience integration.

Oracle Security Will Shape DeFi’s Next Chapter

DeFi has solved the problems it could isolate: reentrancy, flash loan manipulation, and front-running. The remaining vulnerabilities are distributed across dependencies that no single protocol controls.

Oracle providers are responding. Supra patched its verifier within hours. Chainlink, Pyth, and RedStone have expanded security operations and monitoring.

But until DeFi oracle security receives the same sustained investment, cultural attention, and architectural paranoia that eliminated flash loan exploits, the next Bonzo is already being built on top of another trusted, under-scrutinized piece of external infrastructure.

FAQ