Supra Oracle — Bonzo Lend Attack Vector
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·4La73F…n5fgSummary
On July 11, 2026, Hedera's largest lending protocol Bonzo Lend lost approximately $9.05 million after an attacker exploited a signature verification flaw in Supra's on-chain oracle verifier contract. The vulnerable code had been live for at least two years and was deployed to 11 other chains — all of which received a security patch in the days before the Hedera attack — while the Hedera instance remained unpatched. Supra, founded in 2020 and backed by Coinbase Ventures and other institutional investors, is a cross-chain oracle and infrastructure network whose verifier flaw carries systemic risk to any dependent protocol.
Connected Entities
1 entitiesTimeline(13 events)
March 2024
Bonzo Finance migrates from Chainlink to Supra oracles on Hedera, citing Chainlink's absence from the network.
Blockchain Reporter29 June 2026
Supra deploys patched SupraSValueFeedVerifier to Base network — earliest confirmed patch in the pre-exploit rollout.
Protos3 July 2026
Supra patches oracle verifier on Polygon. At least 11 chains total receive the fix between June 29 and July 3, 2026. Hedera deployment is not patched.
Protos11 July 2026
At 00:39:53 UTC, attacker (Wallet A) deposits 250 SAUCE tokens (~$3 value) as collateral into Bonzo Lend on Hedera.
Bonzo Finance Incident Report11 July 2026
At 00:51:39 UTC, attacker submits manipulated SAUCE price to Supra oracle, inflated ~12 orders of magnitude. Supra verifier accepts the zeroed BLS signature.
Bonzo Finance Incident Report11 July 2026
At 00:51:47 UTC, Wallet A borrows 6,634,528 USDC. At 00:51:57 UTC, Wallet A borrows 34.5 million WHBAR. Total extracted: ~$9.05 million.
Bonzo Finance Incident Report11 July 2026
Between 01:11–01:36 UTC, Wallet B (alleged white-hat) borrows ~$1 million under the still-manipulated price window.
Bonzo Finance Incident Report11 July 2026
At 01:36 UTC, legitimate oracle publishing restores SAUCE to normal price (~0.1964 HBAR). At 01:41 UTC, Bonzo Lend is paused.
Blockonomi11 July 2026
Stolen assets bridged via LayerZero/Stargate to Arbitrum, Base, and Ethereum. Wallet A receives approximately $5.25 million equivalent (2,360 ETH, 15.58 WBTC). Funds subsequently routed through Tornado Cash.
Rekt News11 July 2026
Supra deploys the patched verifier to Hedera mainnet approximately 6 hours after the exploit. Fuse network also patched post-exploit.
Protos11 July 2026
Hedera network DeFi TVL falls ~40% within 24 hours to ~$25.7 million. Bonzo Lend TVL falls 77%.
CoinDesk13 July 2026
Supra CEO Joshua Tobkin publicly addresses the attacker, acknowledges two-year on-chain exposure of the vulnerable code, cites AI-assisted hacking as likely exploit vector, and offers $100,000 bounty + immunity + job offer for fund return. No funds recovered from Wallet A as of reporting.
CoinSpectator / Protos23 July 2026
Solido Money protocol suffers a separate exploit involving SUPRA token pricing errors in its Solido Cash product; approximately 293.7 million SUPRA tokens stolen (~$900,000 at time of attack).
Analytics InsightDecision Log
- hash: AubKCWPFdHjdtrKYR1s6mW9NzwzW9teEL9Nqbk1CG6yH
- hash: ErqpW5xtJr6qJaeQYbsyVidTAdynUYnbaTf7fT7PnmBr
- hash: HNKNBrQjwTUArtqXN8EaBK7cTh6gSpzD3MMGSisnwxFw
This investigation is cryptographically anchored to the Solana blockchain (3 events). 16 of 16 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 8/9/2026, 12:29:27 PM
last updated: 8/25/2026, 7:40:30 PM
6 viewsavoid.net — verified advice for a post-truth world