Hedera had a truly divisive week. Meanwhile, an oracle exploit drained $9.05 million from the network’s largest DeFi lending protocol, wiping out nearly 40% of Hedera’s total lock in a single day. Meanwhile, Lloyds Banking Group, Aberdeen Investments and Archix have completed the UK’s first foreign exchange transaction using tokenized real-world assets as collateral for Hedera. This is a real institutional milestone, noted in a Treasury-backed report the same week. Here’s what’s actually happening $HBAR We then explain why the network’s enterprise-focused governance model makes this type of split story more common than in most layer 1 networks.
Important points
- Hedera’s largest DeFi lending protocol, Bonzo Lend, lost approximately $9.05 million on July 11 after attackers exploited a validation flaw in a third-party Supra oracle and manipulated the price of SAUCE tokens to borrow amounts far greater than the amount supported by collateral.
- Hedera’s total locked value decreased by nearly 40% within 24 hours of the exploit, and Bonzo’s own TVL plummeted by 77%. Hedera’s network-wide TVL currently stands at approximately $25.7 million
- $HBAR After the exploit, the stock fell to around $0.067 to $0.069, down about 71% over the past year and about 88% below its all-time high of $0.5692 in September 2021.
- A few days later, Lloyds Banking Group, Aberdeen Investments and Archix completed the UK’s first exchange transaction using tokenized real-world assets as collateral on the Hedera network, which was featured in the Treasury-backed Wholesale Digital Market Champions report.
- The network’s corporate governing body, the Hedera Council, has grown to approximately 31-32 members, including Google, IBM, Boeing, FedEx, Deutsche Telekom and McLaren Racing, each of which operates a network validation node.
- canary capital $HBAR The Spot ETF (HBR) has attracted cumulative inflows of approximately $93 million since launch and has net assets of approximately $49 million, per the SEC and CFTC’s March 2026 classification. $HBAR As a digital product
What happened with the Bonzo Lend exploit?
How the attack works
According to Bonzo’s official incident report, the exploit began around 00:51 UTC on July 11, 2026, when the attacker deposited just 250 SAUCE tokens (worth just a few dollars) and sent manipulated price updates to an on-demand oracle contract. This erroneous update inflated the value of SAUCE by approximately 12 orders of magnitude. And importantly, the Oracle verifier accepted the update even though it contained a zeroized signature rather than a valid signature from an accredited Oracle committee. Eight seconds later, the attacker used the inflated collateral to borrow approximately 6.6 million USDC and 34.5 million Wrapped. $HBAR (WHBAR), worth approximately $9.05 million in total. The second wallet borrowed approximately $1 million during the same period, then revealed itself to the Bonzo team as a white hat counterpart and promised to return the funds. The total amount of abnormal borrowing during the incident was approximately $10.06 million, but Bonzo’s total loss of $9.05 million does not include the funds that the white hat wallet said it would return.
Blockchain security researchers Specter and PeckShield tracked over $5.25 million in stolen funds that were bridged from Hedera to Ethereum via LayerZero and exchanged from Wrapped Bitcoin to ETH. Bonzo Lend and Bonzo Points will remain paused while the team evaluates recovery options. Bonzo Vault, Bonzo Bridge, and one-sided staking are unaffected and will continue to operate normally. Bonzo specifically attributed the failure to a flaw in Supra’s third-party oracle validation infrastructure, and said the incident was not caused by a vulnerability in Bonzo’s own smart contracts or Hedera’s underlying network. This distinction is important because it means that this exploit reflects a weakness in the DeFi protocol’s chosen oracle provider, rather than a flaw in Hedera’s core consensus mechanism. Supra subsequently became aware of the issue and introduced amendments to the affected verifier contracts.
Why it matters beyond the dollar numbers
The real damage from this exploit may be to your trust, not just your balance sheet. The total amount locked across Hedera’s network decreased by nearly 40% in the 24 hours following the incident as users withdrew funds, and Korean exchanges such as Upbit, Bithumb, and CoinOne issued warning notices to investors regarding Hedera. The timing is also noteworthy. This incident was one of three major DeFi exploits in a week, along with the $6 million Summer.fi exploit and the $20 million BonkDAO governance attack, with combined losses of more than $35 million. This is part of a broader pattern in which CertiK’s 2026 H1 report flagged the security environment as “not improving and in some respects getting worse”, despite a downward trend in total dollar losses. For more information on how total value locked across DeFi is tracked, please see our explanation of what DeFiLlama measures.
Institutional aspects of the story: Lloyds, Aberdeen, Archax.
While this exploit was still making headlines, Hedera posted a truly important institutional development. Lloyds Banking Group, Aberdeen Investments and digital asset platform Archax have completed the UK’s first foreign exchange transaction executed on the Hedera network using tokenized real-world assets as collateral. The transaction, which involved tokenized units of Aberdeen Investments’ money market funds and tokenized UK government bonds, was featured in the Treasury-backed Wholesale Digital Market Champions report as an example of practical institutional blockchain adoption. This juxtaposition of a DeFi protocol exploit and a groundbreaking traditional finance pilot that landed on Hedera in the same week captures the fractured nature of Hedera’s current position: a network with true corporate trust, and whose permissionless DeFi layer is subject to the same third-party smart contract risks as other chains.
Who rules Hedera: Hedera Council
Enterprise governance model different from most blockchains
Unlike Bitcoin and Ethereum, Hedera is not governed by anonymous validators or founding teams. It is operated by the Hedera Council (renamed from “Hedera Governing Council” in May 2025). The Hedera Council is a rotating organization of up to 39 global organizations and currently has approximately 31-32 members. Each member, regardless of company size, holds an equal vote on protocol decisions, serves a three-year term (up to two consecutive terms), and must operate a consensus node that verifies transactions on the network. This structure was clearly modeled on Visa’s original 1968 governance framework, in which a council of member banks operated a shared payments network without the control of a single institution.
who are the members of the council
Council members span technology, finance, telecommunications, energy and academia and include Google, IBM, Boeing, FedEx, Dell, Deutsche Telekom, LG Electronics, Standard Bank, Chainlink Labs, Nomura Holdings, Ubisoft, McLaren Racing, Accenture (joining in April 2026 to build an enterprise AI governance infrastructure on the network), as well as the London School of Economics and University College. Includes academic institutions such as London. Changing the total value of Hedera $HBAR The supply is limited to 50 billion tokens and requires the unanimous consent of all council members, which is the highest governance standard within the network structure.
$HBAR Regulatory and institutional context
$HBAR was one of 16 tokens included alongside Bitcoin, Ethereum, Solana, and XRP on the Official Digital Commodity Classification List issued by the SEC and CFTC on March 17, 2026, making it a notable target for expanded regulated entity access to the token. This classification helped pave the way for products like Canary Capital $HBAR The Spot ETF (ticker: HBR) has drawn cumulative inflows of approximately $93 million since its inception and has approximately $49 million in net assets, alongside HashDex index products including: $HBAR exposure.
Related articles
For more information on platforms that track cryptocurrency market data, see our explanations of what Coinglass tracks in derivatives markets and what RWA.xyz measures in tokenized assets. For a broader picture of the crypto market, check out our Today’s Crypto Market and Today’s Crypto News Roundups.
