Supra oracle exploit lets attacker drain $9.05M from Bonzo Lend using zero-signature SAUCE price update

bonzo.finance •

Revision history

2 recorded changes

Want your article here?

An attacker submitted a SAUCE price about 12 orders of magnitude above market after Supra's Hedera verifier accepted a zeroed BLS signature, then used 250 SAUCE as collateral to extract $9.05 million from Bonzo Lend. Bonzo paused Lend at 01:41 UTC after the malicious wallet borrowed 6.63 million USDC and 34.52 million WHBAR. A second wallet said it acted as a white hat and plans to return the additional principal it borrowed, about $1 million.

TLDR by @Benthic

Supra oracle exploit lets attacker drain $9.05M from Bonzo Lend using zero-signature SAUCE price update

Explore the topic

More on Exploit

Hedera faces apparent $5.25M exploit as attacker bridges stolen funds to Ethereum

Summer.fi exploit drains ~$6M as Blockaid links attacker to Lazy Summer contracts

Ethereum Layer 2 Taiko finalizes post-exploit recovery with bridge reopening, confirming full network restoration as a detailed post-mortem nears release

Crypto hackers stole $75.9M across 40 incidents in June, down 7% from May, with Humanity Protocol suffering the month's largest exploit at up to $36M

Taiko sets four-stage chain restart after June 21 exploit with security-reviewed fixes and 1:1 bridge backing

SecondFi says users hit by its $2.4M Cardano wallet exploit could recover funds within two weeks as EMURGO finalizes a restoration plan for 374 affected addresses

Hedera faces apparent $5.25M exploit as attacker bridges stolen funds to Ethereum

Summer.fi exploit drains ~$6M as Blockaid links attacker to Lazy Summer contracts

Ethereum Layer 2 Taiko finalizes post-exploit recovery with bridge reopening, confirming full network restoration as a detailed post-mortem nears release

Crypto hackers stole $75.9M across 40 incidents in June, down 7% from May, with Humanity Protocol suffering the month's largest exploit at up to $36M

Taiko sets four-stage chain restart after June 21 exploit with security-reviewed fixes and 1:1 bridge backing

SecondFi says users hit by its $2.4M Cardano wallet exploit could recover funds within two weeks as EMURGO finalizes a restoration plan for 374 affected addresses

Total stats

How to Earn

Supra oracle exploit lets attacker drain $9.05M from Bonzo Lend using zero-signature SAUCE price update

Explore the topic

More on Exploit

Hedera faces apparent $5.25M exploit as attacker bridges stolen funds to Ethereum

Summer.fi exploit drains ~$6M as Blockaid links attacker to Lazy Summer contracts

Ethereum Layer 2 Taiko finalizes post-exploit recovery with bridge reopening, confirming full network restoration as a detailed post-mortem nears release

Crypto hackers stole $75.9M across 40 incidents in June, down 7% from May, with Humanity Protocol suffering the month's largest exploit at up to $36M

Taiko sets four-stage chain restart after June 21 exploit with security-reviewed fixes and 1:1 bridge backing

SecondFi says users hit by its $2.4M Cardano wallet exploit could recover funds within two weeks as EMURGO finalizes a restoration plan for 374 affected addresses

Hedera faces apparent $5.25M exploit as attacker bridges stolen funds to Ethereum

Summer.fi exploit drains ~$6M as Blockaid links attacker to Lazy Summer contracts

Ethereum Layer 2 Taiko finalizes post-exploit recovery with bridge reopening, confirming full network restoration as a detailed post-mortem nears release

Crypto hackers stole $75.9M across 40 incidents in June, down 7% from May, with Humanity Protocol suffering the month's largest exploit at up to $36M

Taiko sets four-stage chain restart after June 21 exploit with security-reviewed fixes and 1:1 bridge backing

SecondFi says users hit by its $2.4M Cardano wallet exploit could recover funds within two weeks as EMURGO finalizes a restoration plan for 374 affected addresses

Comments

Total stats

How to Earn