Supra Oracle — Bonzo Lend Attack Vector
Summary
On July 11, 2026, Hedera's largest lending protocol Bonzo Lend lost approximately $9.05 million after an attacker exploited a signature verification flaw in Supra's on-chain oracle verifier contract. The vulnerable code had been live for at least two years and was deployed to 11 other chains — all of which received a security patch in the days before the Hedera attack — while the Hedera instance remained unpatched. Supra, founded in 2020 and backed by Coinbase Ventures and other institutional investors, is a cross-chain oracle and infrastructure network whose verifier flaw carries systemic risk to any dependent protocol.
Connected Entities
1 entitiesTimeline(13 events)
2024-03-01
Bonzo Finance migrates from Chainlink to Supra oracles on Hedera, citing Chainlink's absence from the network.
Blockchain Reporter2026-06-29
Supra deploys patched SupraSValueFeedVerifier to Base network — earliest confirmed patch in the pre-exploit rollout.
Protos2026-07-03
Supra patches oracle verifier on Polygon. At least 11 chains total receive the fix between June 29 and July 3, 2026. Hedera deployment is not patched.
Protos2026-07-11
At 00:39:53 UTC, attacker (Wallet A) deposits 250 SAUCE tokens (~$3 value) as collateral into Bonzo Lend on Hedera.
Bonzo Finance Incident Report2026-07-11
At 00:51:39 UTC, attacker submits manipulated SAUCE price to Supra oracle, inflated ~12 orders of magnitude. Supra verifier accepts the zeroed BLS signature.
Bonzo Finance Incident Report2026-07-11
At 00:51:47 UTC, Wallet A borrows 6,634,528 USDC. At 00:51:57 UTC, Wallet A borrows 34.5 million WHBAR. Total extracted: ~$9.05 million.
Bonzo Finance Incident Report2026-07-11
Between 01:11–01:36 UTC, Wallet B (alleged white-hat) borrows ~$1 million under the still-manipulated price window.
Bonzo Finance Incident Report2026-07-11
At 01:36 UTC, legitimate oracle publishing restores SAUCE to normal price (~0.1964 HBAR). At 01:41 UTC, Bonzo Lend is paused.
Blockonomi2026-07-11
Stolen assets bridged via LayerZero/Stargate to Arbitrum, Base, and Ethereum. Wallet A receives approximately $5.25 million equivalent (2,360 ETH, 15.58 WBTC). Funds subsequently routed through Tornado Cash.
Rekt News2026-07-11
Supra deploys the patched verifier to Hedera mainnet approximately 6 hours after the exploit. Fuse network also patched post-exploit.
Protos2026-07-11
Hedera network DeFi TVL falls ~40% within 24 hours to ~$25.7 million. Bonzo Lend TVL falls 77%.
CoinDesk2026-07-13
Supra CEO Joshua Tobkin publicly addresses the attacker, acknowledges two-year on-chain exposure of the vulnerable code, cites AI-assisted hacking as likely exploit vector, and offers $100,000 bounty + immunity + job offer for fund return. No funds recovered from Wallet A as of reporting.
CoinSpectator / Protos2026-07-23
Solido Money protocol suffers a separate exploit involving SUPRA token pricing errors in its Solido Cash product; approximately 293.7 million SUPRA tokens stolen (~$900,000 at time of attack).
Analytics InsightDecision Log
- #1publish⛓ pending8/9/2026, 12:29:38 PMhash: HNKNBrQjwTUArtqXN8EaBK7cTh6gSpzD3MMGSisnwxFw
16 of 16 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 8/9/2026, 12:29:27 PM
last updated: 8/9/2026, 8:58:36 PM
avoid.net — verified advice for a post-truth world