Bonzo Lend: Recovery Portal Launch

The Bonzo Lend recovery portal is open at app.bonzo.finance/redemption. Eligible users can claim for up to 90 days from November 12th, 2026, until 23:59 UTC on February 10th, 2027.

This update follows the October 30th recovery update and replaces its estimates with final figures. It explains how to claim, what the portal shows, which accounts are not included, and what happens after the claim window closes.

The recovery program is run by Bonzo Finance Foundation (the “Foundation”). Bonzo Finance Labs has built the portal and supports it on the Foundation's behalf.

At a glance

• Portal: app.bonzo.finance/redemption is the only official claim link.
• Claim window: 90 days (November 12th, 2026 to February 10th, 2027 at 23:59 UTC).
• Wallets: HashPack, Kabila, or MetaMask (via WalletConnect).
• Which wallet: The same Hedera account that held your Bonzo Lend position on July 11th 2026.
• Fees: Each transaction costs a small HBAR network fee; have some HBAR in that wallet to process the claim transaction(s).
• Help: Open a ticket in the official Discord or ask for community support in #General.

Please stay safe. The team will NEVER DM you first, ask for your seed phrase or private key, or send you a claim link. If anyone does, it is a scam.

How to claim

1. Connect: Visit app.bonzo.finance/redemption and connect the wallet that held your Bonzo Lend position. The status at the top should read "Claims open".
2. Check: Review your position before the exploit and the token entitlement you will receive. The next section explains each figure.
3. Accept the terms (once). The first time you click "Claim", the Claim Terms, Release and Waiver open. Read them to the end, because they include a release of claims; the "I Accept" button unlocks once you reach the bottom. Click "I Accept" and sign in your wallet. In HashPack or Kabila, this sends a short on-chain message that costs a small HBAR fee; in MetaMask, it's a free signature. Either way, no funds move. You only need to do this once.
4. Associate the token, if asked. If a row shows "Associate" with a token name, click it and approve in your wallet. Hedera requires a token to be associated with your account before your account can receive that token. HBAR and WETH do not require a token association to receive them.
5. Claim. Click "Claim" and approve the transaction in your wallet. Once it confirms, the row shows "Claimed" with a link to the transaction.
6. Repeat for each row. Every token is a separate claim; you can claim rows at different times but finish them all before February 10th, 2027, 23:59 UTC.

What you'll see in the portal

Before you connect, the page asks you to connect the wallet that held the affected position.

Once you connect, it shows four parts, from top to bottom:

1. Status: Under "Bonzo Redemption", a label shows whether claims are open. Once they are, it also shows when the claim window closes in UTC. Before claims open, the label reads "Not open yet", a "Redemption isn't live yet" notice appears, and each Claim button is greyed out with "Claims aren't open yet." underneath. Below the status, a short note explains how the redemption works, with a link to more detail.

2. Tokens: One row for each token you will receive. Compensation rows come first, then tokens returned in kind.

• Asset: The token, with its type underneath. "In kind" means the same token you supplied, returned to you. "Compensation" means HBAR or USDC paid for assets that couldn't be returned in kind. "Combined compensation" means both in one amount: HBAR or USDC you supplied, plus more of it as compensation.
• Amount: The exact quantity the contract pays you, fixed in tokens. "Pre-exploit value" underneath shows what that amount was worth at the fixed pre-exploit prices your payout was calculated at, not at today's market prices.
• Claim: Claims that row. If your account isn't associated with that token yet, the button reads "Associate" with the token name first. Once claimed, the row shows "Claimed" with a link to the transaction.

3. Pre-exploit position summary: All figures use fixed pre-exploit prices.

• Total supplied and Total borrowed: The value of your positions just before the exploit.
• Net entitlement value: The full amount your recovery is measured against.
• Redemption payout: The value of everything in the Tokens table, at the same pre-exploit prices.
• Net entitlement receivable: The redemption payout as a share of your net entitlement value. 100% means fully covered.

4. Positions before the exploit: Your supplied and borrowed assets at the snapshot (Hedera block 97,504,677, July 11th 2026 at 00:51 UTC), in two tables, with the amount and value of each. "Collateral" means the asset was enabled as collateral; "Supply only" means it wasn't. Your Lend page may show slightly different balances, because they kept accruing interest until the protocol was paused. Only this snapshot is used to calculate your entitlement.

Other messages you may see:

• "You're not on the redemption list." or "Nothing to claim for this address": The connected wallet has no claim. Check that it's the account that held your Bonzo Lend position.
• "This account is settled manually.": The account is a smart contract, a multisig, or has no key, so it can't claim through the page. Open a ticket in Discord to start manual settlement; see "For Developers" below.
• "Claims are temporarily paused.": Claims will reopen once resumed.

Note: Every dollar figure in the portal uses fixed pre-exploit prices. Your payout is paid in fixed token amounts, so what those tokens are worth today depends on market prices.

For Developers: Smart Contracts & Multisig Accounts

Nine eligible accounts can't use the portal: six smart contracts, two multisig (threshold-key) accounts and one keyless system account. The claim contract only pays the exact address in its claim list, and that address must sign the terms and send the claim itself. A contract can't sign, a threshold-key account can't produce the single-key signature the portal needs, and a keyless account can't sign at all.

Their allocations were calculated under the same rules as every other account and total $18,833.37 at pre-exploit prices. That amount has been set aside outside the claim contract, in a reserve held by the Bonzo Foundation's redemption owner account (0.0.10901569). It does not change anyone else's payout or ability to claim.

The accounts are:

• Smart contracts: 0.0.10620293, 0.0.10084818, 0.0.10375556, 0.0.10377506, 0.0.10382924 and 0.0.10431567
• Multisig accounts: 0.0.6075667 (5 of 8 keys) and 0.0.1089641 (1 of 2 keys)
• System account: 0.0.801, which has no key. Its allocation (under $0.0001) stays reserved until its treatment is decided.

If you deployed one of these contracts or control one of these multisigs, open a ticket in the official Discord and include:

• The account ID.
• A regular single-key wallet where you want to receive the tokens.
• Whether the account held funds for anyone else, such as a vault.

The team will confirm the steps in your ticket. You will need to prove you control the account, for example, with a signature from the contract's admin key or deployer, or a small transaction signed by the multisig's threshold. You will also need to accept the Recovery Program Terms. Once that's done, the exact amounts are sent to your wallet.

Final recovery figures

These replace the estimates displayed in the October 30th recovery update. All values use pre-exploit prices.

• Eligible accounts: 2,466
• Aggregate recovery: 81.39% of total net entitlements
• Fully covered: 1,808 accounts
• With a remaining shortfall: 658 accounts
• Individual recovery: approximately 56.1% to 100%, depending on what each account supplied and borrowed. A shortfall below $0.000001 counts as fully covered.
• Total remaining shortfall: $1,065,255.68

The 81.39% is the combined figure across all accounts, not what each account receives; your own figure is shown in the portal as "Net entitlement receivable". The October 30th update counted 2,535 accounts; the next section explains the difference.

Recovery funds come from four sources:

• Tokens returned in kind from the protocol's remaining reserves.
• 5,550,678.55 HBAR from surplus conversions, including 5,258,686.58 HBAR from the Stader redemption and 291,991.98 HBAR from seven additional SaucerSwap sales.
• 192,030.69 USDC from selling the other surplus tokens (218 trades on Hedera and one WETH sale on Base).
• 795,431 USDC contributed by the Hedera Foundation.

Deposits into the claim contract, and every claim from it, can be checked on HashScan at the redemption contract (0.0.10940273).

Accounts not included

Accounts controlled by Bonzo entities receive nothing from the recovery; their combined pre-exploit net entitlement of $70,259.76 is excluded, and their share was given to the recovery program to further support eligible users.

• Protocol revenue account: 1 account; $67,799.51
• Bonzo Foundation & Labs operational wallets: 4 accounts; $2,442.94
• Bonzo Vaults keeper wallet & strategy contracts: 64 accounts; $17.30
• Total: 69 accounts; $70,259.76

Amounts are pre-exploit net entitlements and may not add up exactly due to rounding.

As previously announced, the following are also not included:

• The largest institutional account, which waived its claim of $8,261,438.83 at pre-exploit prices.
• Wallet B, the white-hat responder, which waived its claim under its release agreement in exchange for the 10% bounty it kept.

This is why the final count is 2,466 rather than the 2,535 estimated on 30 October: Wallet B and 68 newly excluded Bonzo-controlled accounts were removed. The protocol revenue account was already excluded on 30 October.

The Hedera Foundation contribution and remaining shortfall

In July, a full-value recovery at pre-exploit prices, backed by a recovery facility committed by the Hedera Foundation, was announced. The Foundation is grateful for the Hedera Foundation’s contribution of 795,431 USDC, which will substantially reduce the losses borne by users. It is included in the figures above and is paid only to eligible users.

• Our understanding is that the contribution was calculated with reference to the funds taken by Wallet A, after accounting for the institutional allocator’s waived position.
• For the recovery distribution, we also include accounts affected by liquidations during the exploit window, so those users can participate alongside other affected users.
• The available recovery funds also reflect the 10% bounty retained by Wallet B. Together, the recovered assets, surplus proceeds and approved contribution reduce the shortfall, but do not cover all eligible users’ pre-exploit net entitlements.

The recovery funds provider has been provided information on the remaining shortfall. They’ve been given the opportunity to provide additional recoveries or funding but no commitments have been made.

After the claim window closes

The claim window closes on February 10th, 2027 at 23:59 UTC. The Foundation may extend it, but nothing will bring it forward. After it closes, unclaimed allocations can no longer be claimed through the portal.

Unclaimed funds stay with the recovery program. They are not returned to the Hedera Foundation, and its contribution is used only to compensate eligible users. If funds remain, the Foundation may hold a second round of claims.

An account can take part in a second round of claims only if it:

• claimed its entitlement through the official portal by February 10th, 2027 at 23:59 UTC, and
• still has a shortfall after the first round.

A second round would be shared in proportion to each account's remaining shortfall, and no account would receive more than its shortfall. Any further funds the Foundation receives for the recovery, if any, would be shared the same way. A second round is not guaranteed, and its terms would be published before it opens.

Common questions

The portal says I'm not on the redemption list: Check that you connected the Hedera account that held your Bonzo Lend position on July 11th, 2026. If you use more than one wallet app, confirm which account is connected. If it still looks wrong, open a Discord ticket.

Do I have to claim everything at once? No. Each row is claimed separately, and you can come back later. Claim every row before February 10th, 2027, 23:59 UTC.

Why is my payout worth a different amount today? Every dollar figure in the portal uses fixed pre-exploit prices. Your payout is paid in fixed token amounts, so what those tokens are worth today depends on market prices.

Why do I need to associate a token? On Hedera, an account must opt in to a token before it can receive it. The portal only asks when needed. HBAR and WETH don't need it.

I’ve borrowed; do I need to repay anything? No. Your debt was already deducted from your entitlement at pre-exploit prices, and there is no repayment option.

What am I agreeing to when I accept the terms? The terms are a binding agreement with the Foundation. They include a release of claims relating to the exploit and the recovery, and they assign to the Foundation your claims against those responsible for the exploit. Read them in full before you sign.

One of my claims failed; what should I do? Check that you have some HBAR for fees and that the token is associated with your account, then try again. A failed transaction leaves your allocation untouched. If it keeps failing, please open a Discord ticket.

Need help?

Open a ticket in the official Discord, or ask the community in #general. To get help faster, please include in your ticket:

• Your Hedera account ID (0.0.x);
• The wallet app you used;
• A screenshot or video of what you see / the issue you’re experiencing; and
• The transaction ID, if there is one.

Never share your seed phrase or private key. The team will never ask for them.

Disclaimer

Purpose and status. This update is general information only. It is not legal, tax, or investment advice, and it is not an offer to settle any claim. Users should obtain independent advice where appropriate.

The terms control. Participation is governed by the Bonzo Lend Recovery Program Claim Terms, Release and Waiver shown in the portal. If this update differs from those terms, the terms control. This update does not itself settle, release or waive any claim or legal right.

Valuation. Entitlements, payouts and recovery percentages are measured at fixed pre-exploit prices, not current market prices. Token prices change, and the market value of what you receive may be higher or lower than any figure shown here or in the portal. No particular amount, value, or level of recovery is guaranteed.

Technical risk. Smart contracts can contain errors, even after an audit. Claiming involves risks including network outages, wallet problems, token association requirements, and irreversible transactions. You are responsible for securing your wallet and for using only the official portal link.

Availability. Claims may be paused if needed, for example, for security, and the portal may be unavailable at times. The claim window may be extended but will not be shortened.

Second round. A second round depends on funds remaining after the claim window and is not guaranteed.

Taxes and screening. You are responsible for any taxes on what you receive. An allocation may be withheld or suspended where the law or sanctions screening requires it.

Legal rights. Nothing in this update excludes or limits any right or liability that cannot lawfully be excluded or limited.