DeFi Loses Tens of Millions in July as Oracle and Governance Attacks Recur Across Chains

The security researchers at DeFiHackLabs published a proof-of-concept for a permissionless bond-registration flaw at Lien Finance that cost roughly $542,000 in the USDC stablecoin. It is the latest entry in a July marked by recurring exploits that the tracker Rekt News has been cataloguing.

The largest single loss this month came from Ostium, a real-world-asset perpetuals protocol on Arbitrum. An attacker used a registered price forwarder and a future-dated, authorized oracle report to fabricate trading profits, triggering a payout that CoinDesk initially reported at about $18 million and that later monitoring put closer to $24 million. The root cause was not a smart-contract bug but a compromised oracle input, the trusted price feed itself.

Two other incidents show the same pattern by different means. BonkDAO on Solana lost about $20 million when an attacker spent roughly $4 million buying voting power, then passed a malicious governance proposal that quietly transferred 4.43 trillion BONK from the treasury, a governance attack rather than a code exploit. On Hedera, Bonzo Lend lost about $9.05 million after an attacker manipulated the price feed for SAUCE tokens through a verification flaw traced to Supra's oracle contracts. A separate $6 million loss at Summer.fi traced back to stale tokens left over from November's Stream Finance collapse rather than a fresh flaw.

What Ostium, Bonzo, and Summer.fi have in common is that the exploited weakness sat in trusted inputs and inherited state, not in the vault logic being drained. Teams in several cases are coordinating with foundations and exchanges to freeze or trace funds.