Supra oracle exploit lets attacker drain $9.05M from Bonzo Lend using zero-signature SAUCE price update
bonzo.finance β’
Revision history
2 recorded changes
Want your article here?
Promote with Leviathan NewsAn attacker submitted a SAUCE price about 12 orders of magnitude above market after Supra's Hedera verifier accepted a zeroed BLS signature, then used 250 SAUCE as collateral to extract $9.05 million from Bonzo Lend. Bonzo paused Lend at 01:41 UTC after the malicious wallet borrowed 6.63 million USDC and 34.52 million WHBAR. A second wallet said it acted as a white hat and plans to return the additional principal it borrowed, about $1 million.
TLDR by @Benthic
Explore the topic
More on Exploit
Ravencoin faces four-day rollback as 2Miners and RavenMiner rebuild chain after consensus exploit; $RVN drops 17%
Coindesk Β·
OpenAI expands Daybreak with GPT-5.6-Cyber, a specialized model for authorized vulnerability research, exploit validation and advanced cyber defense
π/@Eric_Wallace_ Β·
BTCPay Server offers up to $190K bounty after exploit drains merchant Bitcoin wallets, with attackers using stolen LND credentials to access Lightning funds
Coindesk Β·
BTCPay Server warns active exploit can drain LND wallets, urges immediate update to v2.4.2
π/@BtcpayServer Β·
Blockaid says Coldcard's $111M+ exploit exposes crypto's "original sin" as private keys remain a single point of failure despite offline hardware wallet security
The Block Β·
Galaxy Research says Coldcard exploit losses may reach $130M as a suspected fourth attack wave pushes stolen Bitcoin above 2,000 BTC, with most funds still unmoved
The Block Β·
Ravencoin faces four-day rollback as 2Miners and RavenMiner rebuild chain after consensus exploit; $RVN drops 17%
Coindesk Β·
OpenAI expands Daybreak with GPT-5.6-Cyber, a specialized model for authorized vulnerability research, exploit validation and advanced cyber defense
π/@Eric_Wallace_ Β·
BTCPay Server offers up to $190K bounty after exploit drains merchant Bitcoin wallets, with attackers using stolen LND credentials to access Lightning funds
Coindesk Β·
BTCPay Server warns active exploit can drain LND wallets, urges immediate update to v2.4.2
π/@BtcpayServer Β·
Blockaid says Coldcard's $111M+ exploit exposes crypto's "original sin" as private keys remain a single point of failure despite offline hardware wallet security
The Block Β·
Galaxy Research says Coldcard exploit losses may reach $130M as a suspected fourth attack wave pushes stolen Bitcoin above 2,000 BTC, with most funds still unmoved
The Block Β·