DeFi and Smart Contracts

Oracle attack on Bonzo Finance: patch existed for eight days, just not on Hedera

22. August 2026.

At 00:39:53 UTC, on July 11, 2026, someone deposited 250 SAUCE tokens into Bonzo Lend. They were worth about three dollars. Twelve minutes later, the same wallet sent a fake price update. Eight seconds after that, 6.63 million USDC and 34.5 million WHBAR left the pool.

Final damage: $9.05 million. This oracle attack did not break any private keys, no smart contract of Bonzo was breached, and the Hedera network operated normally the entire time.

The worst part is not the mechanism. A patch for that vulnerability had existed for eight days and was deployed on 11 other chains. It never reached Hedera.

It is worth understanding what happened even if you have never heard of Hedera, because the error is not exotic: a signature check failed, the exact point through which most DeFi infrastructure passes.

What happened in 62 minutes

Bonzo Finance is a lending protocol on the Hedera network, an Aave-style fork. Some deposit funds, others borrow against collateral. For the protocol to know how much collateral is worth, it must get the price externally, from an oracle service. Bonzo used the Supra pull-oracle. That exact seam broke.

Timeline from the official Bonzo incident report:

  • 00:39:53 – attacker deposits 250 SAUCE as collateral, worth about three dollars.
  • 00:51:39 – sends a manipulated price update for SAUCE. The verifier accepts it and writes a nonsensical price on-chain.
  • 00:51:47 – borrows 6,634,528 USDC.
  • 00:51:57 – borrows 34,518,389 WHBAR.
  • ~01:11-01:36 – another wallet withdraws the rest of the liquidity while the inflated price is still active. Its owner will later contact Bonzo as a “white-hat.”
  • 01:36 – a legitimate price publication returns SAUCE to its real value.
  • 01:41 – Bonzo Lend is paused.

SAUCE is really worth about 1.38 cents. The fake update overpriced it by roughly 12 orders of magnitude, about a trillion times. Against three dollars of collateral, the protocol calmly lent out nine million.

The consequence was immediate: Bonzo’s TVL dropped 77 percent, from $11.7 million to below three million in a few hours. The DeFi TVL of the entire Hedera network dropped about 40 percent, a pattern we saw in the Q1 report too: one protocol falls, trust in the whole chain goes with it.

The Hedera Foundation publicly confirmed that the network was not compromised: consensus, hashgraph, and core services worked normally, and the mainnet remained operational. The distinction is repeated in almost every major incident: it was not the network that fell, but the protocol on it, and through a third-party service.

Anatomy of the oracle attack: how a zero passed cryptographic verification

Supra works as a pull-oracle: the protocol requests a signed price, then verifies the BLS signature of the committee that guarantees it. If the signature is valid, the price is accepted.

The attacker referenced committee ID 2 in the query, a committee that was not populated. Instead of rejecting the query, the verifier returned a public key composed entirely of zeros. The attacker also provided a zero signature, [0,0].

Then the math did its part. When both the signature and the public key are zero, both are identity elements, so the pairing product is trivially identity. The Hedera pairing precompile, fully correctly and per EIP-197, returned true. The verifier read that true as “signature is valid.”

For those who do not live in cryptography: you ask for verification from an office that does not exist. Instead of telling you “that office does not exist,” the clerk hands you a blank sheet. You stamp a blank seal on the blank sheet. The machine compares blank with blank, concludes they match perfectly, and lets you through.

The function requireHashVerified_V2 never checked whether the input was degenerate before passing it to the pairing. Three checks were missing: rejecting the identity element, checking that the point is on the curve and in the correct subgroup, and checking that the committee actually has a key. Supra was direct in its postmortem: checking the identity element alone would have prevented the attack.

The patch reached 11 chains, not Hedera

This is the part that makes the incident more than a technical anecdote.

Supra patched the same vulnerability between June 29 and July 3, 2026, through proxy upgrades on 11 chains. Base was patched on June 29, Polygon on July 3. The same SupraSValueFeedVerifier pattern, the same fix.

The rollout stopped at Polygon. Hedera and Fuse remained untouched. Eight days later, on July 11, someone exploited exactly that unpatched instance. Why the rollout was stopped before completion has not been explained. Supra did not even mention the previous 11-chain fix in its first incident report; it described the issue as a “cryptographic edge case.” The verifier on Hedera was patched only after the attack.

For the user, the lesson is more uncomfortable than with an ordinary zero-day flaw: the security of the protocol you use depends not only on whether someone knows about the bug, but also on whether your chain was on the priority list when the patch went out.

The bug was visible for two years

The vulnerable verifier sat unpatched for two years, fully on-chain and visible to anyone who read it. Supra CEO Joshua Tobkin himself discovered it after the incident: “Live. Transparent. For two years straight,” through the entire bull market.

His explanation for why the bug was found only now: AI-assisted hacking. Tobkin describes it as a new class of adversary that “reads every line, every branch, every edge case” and finds what human eyes missed for two years.

If he is right, the adversary changed, not the code. A public contract that “was not attacked” for years was never proof that it was secure; it was proof that no one had read it carefully enough. That difference has now stopped being academic.

Where the money is now

The funds have not been returned. The attacker bridged about $5.25 million, 2,360 ETH and 15.58 WBTC, from Hedera via LayerZero and Stargate, with a path through Arbitrum and Base to Ethereum, and converted WBTC into ETH. Bridging between chains is otherwise a favorite route after a theft: it is fast, liquid, and hard to stop. Later reports mention a balance of about seven million dollars in ETH in a wallet linked to the attacker.

The trail has symmetry: before the attack, the wallet was seeded with 1 ETH from Tornado Cash, and after bridging, the loot headed back into Tornado Cash. The route was followed by on-chain investigator Specter and QuillAudits, while PeckShield linked the initial funding.

The Supra CEO publicly offered the attacker a deal: keep $100,000, return the rest, no criminal charges, and a job offer. If he refuses, a permanent bounty for his unmasking that grows 10 percent annually, forever. There has been no response.

That million dollars from the second wallet is still hanging. The owner presented himself as a white-hat and promised a return; Bonzo lists that amount as “return coordination in progress” and excludes it from the official loss figure. As of the last check, the money has not been returned. The protocol is still paused.

In the meantime, Supra has deployed a patch that rejects identity elements, checks that points are on the curve and in the correct subgroup, and rejects committees without keys.

What this means if you hold money in DeFi

This attack could not be prevented by the user. But exposure could be reduced:

  • Check how many oracle sources the protocol uses. One oracle is one point of failure. Protocols that cross-check multiple independent sources or take a median survive this kind of intrusion with less damage.
  • Look for a circuit breaker. A price jump of 12 orders of magnitude would be stopped by any sanity check. If the protocol has no upper bound on price deviation and no pause on anomaly, it is only a matter of time.
  • Ask what the audit covered, not just whether it exists. The contract was audited, but the service it takes prices from is often outside the audit scope. In Bonzo’s case, that exact seam broke.
  • Check whether the protocol follows patches for its dependencies. Here, the patch existed for eight days and was deployed on 11 other chains. The question “who tracks security updates for the services you depend on” was not theoretical: it was worth nine million.
  • Lending is not savings. A deposit in a lending protocol is an active position with active risk, no matter how much the interface looks like a banking app. Do not keep there what you cannot afford to lose, and do not keep everything in one place.
  • Follow on-chain investigators, not just official channels. Independent analysts tracked the flow of funds in real time. If your liquidity depends on reaction speed, the protocol’s official account is too slow a source.

Frequently asked questions

What is an oracle in DeFi? A service that brings data from the outside world to a smart contract, most often a token price. The contract itself cannot “look” at an exchange, so it trusts the oracle. If the oracle accepts a lie, the contract makes correct decisions based on wrong data.

Was the Hedera network hacked? No. The Hedera Foundation confirmed that consensus, hashgraph, and core services were not compromised and that the mainnet remained operational. What fell was a protocol on the network, through a third-party oracle service.

How much was stolen exactly? $9.05 million in principal, according to Bonzo’s official incident report: 6,634,528 USDC and 34,518,389 WHBAR. An additional roughly one million dollars was withdrawn by a second wallet whose owner presented himself as a white-hat; that amount is not included in the official loss figure.

Have the funds been returned? No. About 5.25 million was bridged to Ethereum and other chains and passed through Tornado Cash. The public offer to the attacker went unanswered. The white-hat million has not been returned either; Bonzo lists it as a return in coordination.

Why was the patch not deployed on Hedera? Supra patched the same vulnerability on 11 chains between June 29 and July 3, 2026, but the rollout stopped before Hedera and Fuse. The reason for the stop has not been publicly explained. The verifier on Hedera was patched only after the attack.

How do I know if the protocol I use is vulnerable to the same attack? If it uses a single oracle without cross-checking, has no upper bound on price deviation, and has no pause on anomaly, it is exposed to the same class of attack, regardless of which oracle service it uses. The Supra verifier itself is patched, but the pattern of “a check that treats degenerate input as valid” is not tied to one provider.

Sources

← Nazad na BlockchainSecurity.rs
Scroll to Top