Supra Oracle Bug Led to $9M Bonzo Lend Exploit on Hedera

A recent $9 million exploit on the Bonzo Lend platform has highlighted a critical security failure in Supra oracle technology. The attack occurred because the oracle mispriced collateral, allowing an attacker to borrow funds far beyond the true value of their assets. A separate white hat hacker also managed to recover an additional $1 million during the incident.

Evidence suggests the vulnerability was known prior to the attack. Records show that Supra updated its oracle contracts on 11 different blockchains between late June and early July. However, the Hedera implementation remained unpatched until roughly six hours after the hack took place.

Supra CEO Josh Tobkin described the issue as a complex cryptographic edge case that had gone unnoticed for two years. While the company stated it has since reviewed all oracle deployments, the delay in updating the Hedera network created the window of opportunity that led to the significant financial losses.

This incident serves as a reminder of the risks associated with third party oracles in decentralized finance. When these services fail to provide accurate price data, lending platforms often suffer from collateral manipulation. Investors should continue to monitor how projects select and maintain their data feeds to avoid similar exploits in the future.