Bonzo Lend Review: Should You Use Hedera Lending?

Bonzo Lend is a lending protocol on Hedera. You can supply supported assets to earn yield, or deposit collateral and borrow another supported asset. Bonzo describes the protocol as open source, non-custodial and based on Aave. Supported assets listed include HBAR, HBARX, USDC, SAUCE, XSAUCE, KARATE, DOVU, BONZO and others; the app’s active markets may differ, so check there before acting.

Supplying is not the same as holding tokens in your wallet: assets are controlled by the protocol’s smart contracts while deposited. Borrowing also introduces liquidation risk if your collateral value falls or your position no longer meets the market’s requirements. Bonzo advertises separate vaults, points and BONZO staking, but those are distinct features and do not remove the risks of lending or borrowing. The homepage dashboard displayed zero total value locked and zero active borrows, while TVL was unavailable in the protocol listing. Those figures do not confirm usable liquidity. Check the actual market balances before supplying or relying on a withdrawal.

Bonzo has not published a complete schedule of lending, borrowing or withdrawal costs in the project details here. Before using a market, check the app for the supply rate, borrow rate, any protocol charge, and the terms that apply to liquidations. Rates in pooled lending markets can change as supply and borrowing shift, so a displayed yield is not a guaranteed return.

You may also pay Hedera network fees for transactions such as supplying, borrowing, repaying or withdrawing. Those are separate from any protocol charges. If you borrow, compare the cost of the debt with the value and risk of the collateral; a position can be liquidated if it no longer meets the protocol’s requirements. Don’t rely on a headline APY or a points incentive to estimate your net return. Bonzo promotes points and BONZO rewards elsewhere in its ecosystem, but their terms and value should not be treated as a substitute for checking the lending market’s actual rates and costs.

Bonzo describes Lend as non-custodial, which means the protocol uses smart contracts rather than a conventional custodian holding a customer account. That removes some custodial risks, not the risk of a contract flaw, an oracle problem or a liquidation. Your funds can still be exposed to protocol failures.

Bonzo says its codebase has undergone audits by Halborn; its security materials also list a full protocol audit, formal verification and a bug bounty program, and say secondary audits are underway. A directory lists two audits, but an audit is not a guarantee that funds are safe. More importantly, a reported oracle attack on July 11, 2026 affected Bonzo Lend. The loss amount, affected markets and recovery status remain unclear. Do not deposit until you can confirm directly from Bonzo which contracts and markets are affected, whether deposits and withdrawals are operating normally, and what steps the protocol has taken. Bonzo’s licensing status and a detailed custody or incident-recovery policy are not published here.

Bonzo is built for Hedera, and the project promotes a launch app connected to Hedera Mainnet. The listed assets include both Hedera-native tokens and assets such as WETH and Stargate (LayerZero), but that list alone does not establish which markets are active or how each asset is bridged. Confirm the network and token contract details in the app before approving a transaction.

Bonzo has not published a wallet compatibility list in the project details here. Use only a wallet the app itself identifies as supported, and check that it is connected to Hedera Mainnet before approving anything. The dashboard displayed loading and zero-value fields, so it does not establish that market data or liquidity is currently available. There is no confirmed information here about transaction speed, mobile-specific support or a mobile app. If rates, balances or the status of a market fail to load, don’t proceed on the assumption that the displayed market is live.

The biggest reason to pause is the reported oracle attack. An oracle supplies price information that lending contracts can use to value collateral and debt; incorrect prices can affect borrowing and liquidations. The available account of the incident does not establish which positions or contracts were affected, whether funds were lost, or whether the issue has been fully resolved. That uncertainty is material when deciding whether to deposit or borrow.

Liquidity is another concern: the dashboard showed zero balances and the protocol’s listed TVL was unavailable. A low-liquidity market can make it harder to withdraw or borrow the amount you expect. Fees, wallet support, licensing and detailed incident status are also not clearly published here. If you do proceed after verifying the incident and a market’s liquidity, start small, avoid borrowing near liquidation thresholds and keep records of your transactions. If you cannot confirm that withdrawals work and the relevant contracts are safe to use, choose another option rather than treating the advertised features or audit claims as proof of safety.