Skip to main content
AVOID.NET
Sign in

Supra Oracle — Bonzo Lend Attack Vector

avoid.net/supra-oracle-bonzo-lend-attack-vector→12/100·88% conf.
[AI-DRAFTED · AWAITING VERIFICATION]

Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.

anchored·4La73F…n5fg

Summary

On July 11, 2026, Hedera's largest lending protocol Bonzo Lend lost approximately $9.05 million after an attacker exploited a signature verification flaw in Supra's on-chain oracle verifier contract. The vulnerable code had been live for at least two years and was deployed to 11 other chains — all of which received a security patch in the days before the Hedera attack — while the Hedera instance remained unpatched. Supra, founded in 2020 and backed by Coinbase Ventures and other institutional investors, is a cross-chain oracle and infrastructure network whose verifier flaw carries systemic risk to any dependent protocol.

Connected Entities

11 entities · 60 linked investigations
Organizations
□Polygon54□Chainlink□Ethereum□Arbitrum□Hedera□Base□Supra Oracle — Bonzo Lend Attack Vector□Bonzo Lend
Protocols
⌂Bonzo Finance⌂LayerZero — DVN Single-Verifier Configuration Risk
Tokens
♦Coinbase
Relationships
  • Ethereum→mentioned with→Coinbase(60%)
  • Hedera→mentioned with→Chainlink(70%)
  • Hedera→mentioned with→Ethereum(60%)
  • Bonzo Lend→mentioned with→LayerZero — DVN Single-Verifier Configuration Risk(80%)
  • Chainlink→mentioned with→Ethereum(65%)
  • Chainlink→mentioned with→Coinbase(65%)
  • Coinbase→mentioned with→Base(70%)
  • LayerZero — DVN Single-Verifier Configuration Risk→mentioned with→Chainlink(70%)
  • LayerZero — DVN Single-Verifier Configuration Risk→mentioned with→Ethereum(60%)
  • Supra Oracle — Bonzo Lend Attack Vector→mentioned with→LayerZero — DVN Single-Verifier Configuration Risk(65%)
  • + 27 more
Also appears in
Polygon·54StableMagnet·2Shibarium·28JUDAO·18Shibarium Bridge·32Andean Medjedovic·2Ionic Money·14Allo Protocol·57AnubisDAO·2SushiSwap RouteProcessor Exploit·54+ 50 more

Connected Through

11 shared actors · 635 investigations

Distinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.

Have evidence about Supra Oracle — Bonzo Lend Attack Vector?

Timeline(13 events)

March 2024

Bonzo Finance migrates from Chainlink to Supra oracles on Hedera, citing Chainlink's absence from the network.

Blockchain Reporter

29 June 2026

Supra deploys patched SupraSValueFeedVerifier to Base network — earliest confirmed patch in the pre-exploit rollout.

Protos

3 July 2026

Supra patches oracle verifier on Polygon. At least 11 chains total receive the fix between June 29 and July 3, 2026. Hedera deployment is not patched.

Protos

11 July 2026

At 00:39:53 UTC, attacker (Wallet A) deposits 250 SAUCE tokens (~$3 value) as collateral into Bonzo Lend on Hedera.

Bonzo Finance Incident Report

11 July 2026

At 00:51:39 UTC, attacker submits manipulated SAUCE price to Supra oracle, inflated ~12 orders of magnitude. Supra verifier accepts the zeroed BLS signature.

Bonzo Finance Incident Report

11 July 2026

At 00:51:47 UTC, Wallet A borrows 6,634,528 USDC. At 00:51:57 UTC, Wallet A borrows 34.5 million WHBAR. Total extracted: ~$9.05 million.

Bonzo Finance Incident Report

11 July 2026

Between 01:11–01:36 UTC, Wallet B (alleged white-hat) borrows ~$1 million under the still-manipulated price window.

Bonzo Finance Incident Report

11 July 2026

At 01:36 UTC, legitimate oracle publishing restores SAUCE to normal price (~0.1964 HBAR). At 01:41 UTC, Bonzo Lend is paused.

Blockonomi

11 July 2026

Stolen assets bridged via LayerZero/Stargate to Arbitrum, Base, and Ethereum. Wallet A receives approximately $5.25 million equivalent (2,360 ETH, 15.58 WBTC). Funds subsequently routed through Tornado Cash.

Rekt News

11 July 2026

Supra deploys the patched verifier to Hedera mainnet approximately 6 hours after the exploit. Fuse network also patched post-exploit.

Protos

11 July 2026

Hedera network DeFi TVL falls ~40% within 24 hours to ~$25.7 million. Bonzo Lend TVL falls 77%.

CoinDesk

13 July 2026

Supra CEO Joshua Tobkin publicly addresses the attacker, acknowledges two-year on-chain exposure of the vulnerable code, cites AI-assisted hacking as likely exploit vector, and offers $100,000 bounty + immunity + job offer for fund return. No funds recovered from Wallet A as of reporting.

CoinSpectator / Protos

23 July 2026

Solido Money protocol suffers a separate exploit involving SUPRA token pricing errors in its Solido Cash product; approximately 293.7 million SUPRA tokens stolen (~$900,000 at time of attack).

Analytics Insight
Provenance & Audit Trail
Anchored on SolanaVerify on-chain16 Wayback Archives

Decision Log

This investigation is cryptographically anchored to the Solana blockchain (3 events). 16 of 16 cited source URLs have an Internet Archive snapshot.

full audit log →version history →

model: claude-sonnet-4-6

generated: 8/9/2026, 12:29:27 PM

last updated: 8/25/2026, 7:40:30 PM

6 views

avoid.net — verified advice for a post-truth world