Supra's Verifier Accepted a Zeroed Signature and Bonzo Lend Lost $9 Million

What Happened

At roughly 00:51 UTC on Saturday, July 11, an attacker submitted a manipulated price update for SAUCE, a Hedera ecosystem token, to an on-demand oracle contract operated by Supra, a third-party oracle provider. SAUCE was trading at about 0.2 HBAR (Hedera's native token). The malicious update inflated its recorded value by roughly 12 orders of magnitude.

That update should have been impossible to land: price submissions must carry a valid cryptographic signature from Supra's authorized oracle committee, and this one carried a zeroed signature, a blank where the proof belongs. Supra's on-chain verifier accepted it anyway and wrote the false price to the chain.

8 seconds after the false price went live, the attacker deposited 250 SAUCE, worth a few dollars at the real price, as collateral on Bonzo Lend, the largest lending protocol on Hedera. Against collateral the protocol now believed was astronomically valuable, the wallet borrowed roughly 6.

63 million USDC (a dollar stablecoin) and 34.5 million wrapped HBAR. Bonzo Finance Labs calculated the principal taken at approximately $9.05 million, and on-chain trackers followed more than $5.25 million of it across a bridge from Hedera to Ethereum within hours. A 2nd wallet borrowed roughly another $1 million while the inflated price was live, then identified itself as a white-hat and offered to return the funds.

The legitimate feed restored SAUCE to about 0.1964 HBAR at 01:36 UTC, and Bonzo paused its Lend market 5 minutes later. Supra acknowledged the verification flaw and deployed a fix to the affected contract on Hedera mainnet the same day.

The industry audits the logic and outsources the checking. Bonzo's contracts did exactly what they were told; the layer that decides what is true told them a lie.

A Blank Where the Proof Should Be

What separates this from an ordinary oracle attack is what the verifier did. Classic oracle manipulation works by moving a real price: dump a thinly traded token in the pool an oracle reads, and the oracle honestly reports a dishonest market. Lending protocols have spent years building defenses against that pattern, from time-weighted averages to multi-source medians to deviation circuit breakers.

None of them mattered here, because the attacker never moved a market. According to Bonzo's incident report, the update carried a zeroed BLS signature (Boneh-Lynn-Shacham, the aggregate signature scheme Supra's oracle committee uses to attest that a price is genuine), and a flaw in Supra's verifier contract treated that empty signature as valid.

In other words, the cryptography was never broken. It was never consulted. The signature scheme, the oracle committee, the decentralized network of data providers: all of it was bypassed by a verification function that returned true for a proof of nothing. Bonzo's lending contracts, audited code that behaved exactly to spec, consumed the false price the way they consume every price, because a lending protocol has no independent idea what anything is worth.

Its entire picture of reality arrives through the oracle. The attacker did not pick the lock. The lock was painted on.

The Checking Layer Keeps Failing Open

Readers of this site have seen this shape twice in the past 3 weeks. In June, an attacker drained $1.7 million from a bridge on Taiko with a forged proof its verifier accepted, covered in '$1.7 Million Drained Through a Single Forged Proof on Taiko.' 8 days ago it was Hinkal, which lost $820,000 because its privacy proof verification checked, in effect, nothing, covered in 'Hinkal Lost $820,000 After Its Privacy Proof Verification Failed to Verify Anything.'

Now a verifier on Hedera has accepted a signature of zeros. 3 incidents, 3 chains, 3 different vendors, 1 failure class: the layer whose only job is to check a proof failed open, and everything downstream trusted it.

Supra's defenders have a case, and it deserves stating. This was a vendor bug, not a flaw in Bonzo's design or in lending architecture generally; the response was fast, with a fix deployed within hours; the attack was legible on-chain in real time; and a white-hat came to the table offering back roughly $1 million.

All true. What that defense cannot answer is the market's verdict on the blast radius. Composability means a protocol inherits the weakest assumption of every dependency it wires in, and depositors priced that inheritance immediately: Bonzo's total value locked (TVL) fell 77%, and Hedera's decentralized finance (DeFi) TVL reportedly dropped close to 40% within 24 hours, punishing protocols that had no connection to the flawed verifier.

Nobody waited to find out whose bug it was. That is what trust inversion looks like at ecosystem scale: infrastructure installed to make lending safer, a decentralized oracle attested by committee signatures, became the single point through which an entire chain's credibility drained.

What This Means for You

If you lend, farm, or hold assets inside any DeFi protocol, the working question is not whether the contracts are audited. Bonzo's were, and they executed to spec. The question is what the protocol trusts: which oracle feeds it prices, which bridge mints its collateral, which multisig can upgrade its contracts, and what happens to your deposit when any one of them tells it a lie.

Each dependency is a counterparty, whatever the branding says about decentralization. A practical test: if you cannot name a protocol's oracle provider after 10 minutes in its documentation, you have no basis for sizing the custodial risk you are carrying there.

Be equally honest about what escapes this failure class and what the escape costs. Bitcoin held in self-custody on a hardware wallet carries no oracle dependency, and nothing in this incident could have reached it. But that safety is bought by giving up exactly what oracles provide: no price feed means no lending market, no collateralized borrowing, no yield.

The lesson is not that self-custody wins. It is that yield is compensation for a stack of trust assumptions, and this week one of those assumptions turned out to be a verification function that approved a blank signature. Size DeFi positions as at-risk capital priced against that kind of surprise, and keep the private keys to wealth you cannot afford to re-earn out of the stack entirely.

For Hedera users specifically: confirm which of your protocols read from the patched Supra verifier before trusting quoted prices, and wait for Bonzo's full post-mortem before re-depositing into the paused markets. Bonzo says its Vaults, Bridge, and staking products were unaffected; verify status against the team's official channels rather than screenshots circulating on social media.

What to Watch

Bonzo has published an initial incident report and promised further updates; how long the flawed verifier was live, and whether the same contract runs on other chains, are the numbers that will size this incident properly. Watch whether any of the $5.25 million bridged to Ethereum gets frozen at centralized chokepoints, which will determine whether depositors see restitution.

If the white-hat wallet returns its borrowings as offered, the net loss shrinks materially; if it goes quiet, the offer was cover. And whether lending protocols respond by publishing the dependency manifests users currently have to reverse-engineer will show whether the industry learned the class of lesson or just patched the instance.

Tracked entities this report names, with total coverage across the archive. Follow one into the Actor Network to see every report it appears in.

Other reports that name the same tracked actors — a different thread than “related,” which follows wording. These are linked by who appears in them.