Technical Mechanism: The "Zero-Signature" Bypass
Published 7/13/2026, 2:02:53 PM
The Bonzo Lend exploit on July 11, 2026, resulted in a $9.05 million loss and highlights a critical systemic vulnerability in how on-chain oracles verify cryptographic signatures. The incident was not caused by a flaw in Bonzo Lend’s lending logic, but by a "zero-signature" bypass in Supra’s oracle verifier contract on the Hedera network [Source: https://x.com/ilmeaalim/status/2075905177203417317].
Technical Mechanism: The "Zero-Signature" Bypass
The attacker exploited a mathematical edge case in the BLS (Boneh-Lynn-Shacham) signature verification logic within the Supra verifier contract (requireHashVerified_V2).
- Collateral Deposit: The attacker deposited a mere 250 SAUCE tokens (valued at approximately $50) [Source: https://www.tradingview.com/news/cointelegraph:3049486b1094b:0-bonzo-lend-loses-9m-in-oracle-exploit-on-hedera/].
- Oracle Manipulation: They submitted a price update for the SAUCE/wHBAR pair, inflating the price by 12 orders of magnitude (a value of 1 followed by 30 zeroes) [Source: https://x.com/ilmeaalim/status/2075905177203417317].
- Verification Failure: The attacker provided a zeroed BLS signature
[0,0]. The verifier passed this to Hedera’s pairing precompile (system contract0.0.8). Because both the signature and the public key resolved to the "point at infinity" (zero), the pairing equation was satisfied trivially, returningtrueand validating the fraudulent price [Source: https://x.com/ilmeaalim/status/2075905177203417317]. - The Drain: With the inflated collateral value, the attacker borrowed 6.63M USDC and 34.52M wHBAR [Source: https://x.com/ilmeaalim/status/2075905177203417317].
Systemic Risk and Oracle Vulnerabilities
This exploit reveals that the security of DeFi protocols is increasingly dependent on the infrastructure verification layer rather than just the data accuracy itself.
| Metric | Impact Details | Source |
|---|---|---|
| Total Stolen | $9.05M (Primary attacker) + ~$1M (White-hat) | Source |
| Bonzo TVL Drop | 77% decrease following the exploit | Source |
| Hedera Ecosystem TVL | 40% drop within 24 hours | Source |
| Root Cause | Cryptographic verification failure (Supra Oracle) | Source |
Broader Implications for DeFi
The Bonzo Lend incident confirms a systemic pattern where BLS-based oracles may be vulnerable if they do not strictly validate non-zero inputs and subgroup membership. While traditional oracle attacks often involve market manipulation (e.g., Mango Markets), this exploit represents a cryptographic failure that could theoretically affect any protocol using similar push-model oracle configurations that lack robust input validation [Source: https://x.com/ilmeaalim/status/2075905177203417317].
Current Status:
- Funds: The primary attacker bridged approximately $5.8M to $7M in assets to Ethereum via LayerZero, swapping them into ETH [Source: https://whale-alert.io/stories/cdcc018de733ce/Lending-Protocol-Bonzo-Loses-9-Million-in-Hedera-Oracle-Exploit].
- Remediation: Supra has deployed a fix to the verifier contract on Hedera. Bonzo Lend remains partially paused while recovery efforts continue [Source: https://x.com/ilmeaalim/status/2075905177203417317].
While the specific mathematical flaw in the Supra verifier has been patched, the event serves as a warning that protocols must audit not only their own code but the underlying cryptographic assumptions of their third-party oracle providers.