Supra Oracle — Bonzo Lend Attack Vector
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·4La73F…n5fgSummary
On July 11, 2026, Hedera's largest lending protocol Bonzo Lend lost approximately $9.05 million after an attacker exploited a signature verification flaw in Supra's on-chain oracle verifier contract. The vulnerable code had been live for at least two years and was deployed to 11 other chains — all of which received a security patch in the days before the Hedera attack — while the Hedera instance remained unpatched. Supra, founded in 2020 and backed by Coinbase Ventures and other institutional investors, is a cross-chain oracle and infrastructure network whose verifier flaw carries systemic risk to any dependent protocol.
Connected Entities
11 entities · 60 linked investigations- Ethereum→mentioned with→Coinbase(60%)
- Hedera→mentioned with→Chainlink(70%)
- Hedera→mentioned with→Ethereum(60%)
- Bonzo Lend→mentioned with→LayerZero — DVN Single-Verifier Configuration Risk(80%)
- Chainlink→mentioned with→Ethereum(65%)
- Chainlink→mentioned with→Coinbase(65%)
- Coinbase→mentioned with→Base(70%)
- LayerZero — DVN Single-Verifier Configuration Risk→mentioned with→Chainlink(70%)
- LayerZero — DVN Single-Verifier Configuration Risk→mentioned with→Ethereum(60%)
- Supra Oracle — Bonzo Lend Attack Vector→mentioned with→LayerZero — DVN Single-Verifier Configuration Risk(65%)
- + 27 more
Connected Through
11 shared actors · 629 investigationsDistinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.
- □Ethereumorganization
- ♦Coinbasetoken
- □Arbitrumorganization
- □Polygonorganization
Timeline(13 events)
March 2024
Bonzo Finance migrates from Chainlink to Supra oracles on Hedera, citing Chainlink's absence from the network.
Blockchain Reporter29 June 2026
Supra deploys patched SupraSValueFeedVerifier to Base network — earliest confirmed patch in the pre-exploit rollout.
Protos3 July 2026
Supra patches oracle verifier on Polygon. At least 11 chains total receive the fix between June 29 and July 3, 2026. Hedera deployment is not patched.
Protos11 July 2026
At 00:39:53 UTC, attacker (Wallet A) deposits 250 SAUCE tokens (~$3 value) as collateral into Bonzo Lend on Hedera.
Bonzo Finance Incident Report11 July 2026
At 00:51:39 UTC, attacker submits manipulated SAUCE price to Supra oracle, inflated ~12 orders of magnitude. Supra verifier accepts the zeroed BLS signature.
Bonzo Finance Incident Report11 July 2026
At 00:51:47 UTC, Wallet A borrows 6,634,528 USDC. At 00:51:57 UTC, Wallet A borrows 34.5 million WHBAR. Total extracted: ~$9.05 million.
Bonzo Finance Incident Report11 July 2026
Between 01:11–01:36 UTC, Wallet B (alleged white-hat) borrows ~$1 million under the still-manipulated price window.
Bonzo Finance Incident Report11 July 2026
At 01:36 UTC, legitimate oracle publishing restores SAUCE to normal price (~0.1964 HBAR). At 01:41 UTC, Bonzo Lend is paused.
Blockonomi11 July 2026
Stolen assets bridged via LayerZero/Stargate to Arbitrum, Base, and Ethereum. Wallet A receives approximately $5.25 million equivalent (2,360 ETH, 15.58 WBTC). Funds subsequently routed through Tornado Cash.
Rekt News11 July 2026
Supra deploys the patched verifier to Hedera mainnet approximately 6 hours after the exploit. Fuse network also patched post-exploit.
Protos11 July 2026
Hedera network DeFi TVL falls ~40% within 24 hours to ~$25.7 million. Bonzo Lend TVL falls 77%.
CoinDesk13 July 2026
Supra CEO Joshua Tobkin publicly addresses the attacker, acknowledges two-year on-chain exposure of the vulnerable code, cites AI-assisted hacking as likely exploit vector, and offers $100,000 bounty + immunity + job offer for fund return. No funds recovered from Wallet A as of reporting.
CoinSpectator / Protos23 July 2026
Solido Money protocol suffers a separate exploit involving SUPRA token pricing errors in its Solido Cash product; approximately 293.7 million SUPRA tokens stolen (~$900,000 at time of attack).
Analytics InsightDecision Log
- slot 457558841 · hash 6G82pLxiRbomA9qS1sgSQwcQRtXjKC6mpqevgUCA1D1b
- slot 457551077 · hash AtPqy1LNfZJF2d5EhzXHBkU1YWuT8MaE6wruu4dEc8Wz
- slot 443516948 · hash AubKCWPFdHjdtrKYR1s6mW9NzwzW9teEL9Nqbk1CG6yH
- slot 443516920 · hash ErqpW5xtJr6qJaeQYbsyVidTAdynUYnbaTf7fT7PnmBr
- slot 443506312 · hash HNKNBrQjwTUArtqXN8EaBK7cTh6gSpzD3MMGSisnwxFw
This investigation is cryptographically anchored to the Solana blockchain (5 decisions). 16 of 16 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 8/9/2026, 12:29:27 PM
last updated: 8/25/2026, 7:40:31 PM
8 viewsavoid.net — verified advice for a post-truth world