{"id":9233,"date":"2026-07-16T13:51:07","date_gmt":"2026-07-16T10:51:07","guid":{"rendered":"https:\/\/handoli.com\/index.php\/2026\/07\/16\/supra-patched-oracle-on-11-other-chains-before-9m-hedera-exploit\/"},"modified":"2026-07-16T13:51:07","modified_gmt":"2026-07-16T10:51:07","slug":"supra-patched-oracle-on-11-other-chains-before-9m-hedera-exploit","status":"publish","type":"post","link":"https:\/\/handoli.com\/index.php\/2026\/07\/16\/supra-patched-oracle-on-11-other-chains-before-9m-hedera-exploit\/","title":{"rendered":"Supra patched oracle on 11 other chains before $9M Hedera exploit"},"content":{"rendered":"
<\/div>\n

A faulty oracle that caused a $9 million exploit over the weekend was patched on 11 chains in the days leading up to the attack, with the exploited Hedera deployment left vulnerable.<\/p>\n

The affected protocol, Bonzo Lend, explained<\/a> that the oracle accepted an extreme mispricing of the attacker\u2019s collateral asset, which allowed them to borrow funds far in excess of the collateral\u2019s true value. <\/p>\n

A further $1 million was extracted by a white-hat hacker.<\/p>\n

The vulnerable oracle was created by blockchain infrastructure developer Supra Network, which boasts<\/a> oracles \u201clive on 67 mainnets.\u201d<\/p>\n

Shortly after the exploit, Plasma\u2019s Usmann Khan noted<\/a> that Supra had upgraded many of its oracles in the days leading up to the exploit, but not the contract on Hedera, which Bonzo Lend used.<\/p>\n

\n
\n
\n

rough one. looks like @SUPRA_Labs<\/a> actually knew about this exploit in their oracle. on more important networks like Arbitrum they upgraded their impls over the last 2wks (previously untouched for years). someone must have noticed this and found the forgotten Hedera instance https:\/\/t.co\/8Fk2ZL4WY1<\/a> pic.twitter.com\/GsyfORQExk<\/a><\/p>\n

\u2014 usmann (@usmannk) July 11, 2026<\/a><\/p><\/blockquote>\n<\/div>\n<\/figure>\n

Read more: <\/em>These crypto chains raised $500M but generate just $360 in daily fees<\/em><\/a><\/p>\n

In an incident report<\/a> published approximately 12 hours after the attack, Supra called the bug a \u201ccryptographic edge case\u201d and doesn\u2019t mention having fixed deployments on other chains.<\/p>\n

It simply states, \u201cWe have also reviewed every other Supra oracle deployment that shares this verifier pattern to confirm the same guards are in place.\u201d<\/p>\n

Supra\u2019s co-founder and CEO Josh Tobkin blamed<\/a> \u201cAI-assisted hacking\u201d for discovering \u201cwhat human eyes had missed\u201d for two years.<\/p>\n

Patching the bug<\/h2>\n

However, following Khan\u2019s post, HSuite founder Tomachi Anura analysed<\/a> Supra\u2019s on-chain activity.<\/p>\n

\n
\n
\n

Everyone reported @SUPRA_Labs<\/a> patched their @hedera<\/a> contracts AFTER the $9M Bonzo hack.<\/p>\n

The on-chain record shows @SUPRA_Labs<\/a> shipped that exact fix to 11 chains days before Hedera was drained \u2014 and patched Hedera ~6h after.<\/p>\n

I’ve been digging deep, and presenting pure facts as\u2026 https:\/\/t.co\/n72jwQZdDl<\/a><\/p>\n

\u2014 Tomachi Anura (@TomachiAnura) July 14, 2026<\/a><\/p><\/blockquote>\n<\/div>\n<\/figure>\n

Read more: <\/em>Cap \u2018stabledrop\u2019 U-turn sees cUSD drop $23M, founder denies self dealing claims<\/em><\/a><\/p>\n

Anura\u2019s post details the firm\u2019s \u201ccross-chain fix rollout\u201d, with proxy upgrades on 11 chains between June 29 (Base<\/a>) and July 3 (Polygon<\/a>), with a further two fixes (on Hedera<\/a> and Fuse<\/a> taking place post-exploit). <\/p>\n

Anura insists that, while some upgrade addresses vary, \u201cevery one whose source is verified resolves to the same 17,354-char guarded SupraSValueFeedVerifier.\u201d<\/p>\n

It remains unclear why the fixes stopped on July 3, leaving the Hedera deployment vulnerable.<\/p>\n

Protos has reached out to Supra for clarification, and will update this article should we hear back.<\/p>\n

Read more: <\/em>Oracle error adds to turmoil at DeFi giant Aave<\/em><\/a><\/p>\n

Oracles\u2019 costly misfires<\/strong><\/h2>\n

Third-party oracles are used by many DeFi projects\u2019 smart contracts to price assets, or for other external data feeds.<\/p>\n

Oracle manipulation attacks are commonly used, like in this case, to inflate the value of a collateral asset and drain available borrow liquidity on DeFi lending platforms.\u00a0<\/p>\n

Oracle exploits<\/a> have led to a further $3.5 million in losses in recent months. In one incident<\/a>, the critical change to Moonwell\u2019s \u201cvibe-coded\u201d oracle was co-authored by Claude.<\/p>\n

While not strictly an exploit, a timestamp mismatch error in Chaos Labs\u2019 Correlated Asset Price Oracle led to a staggering $27 million<\/a> worth of erroneous wstETH liquidations on Aave\u2019s Ethereum markets in March.<\/p>\n

Got a tip? Send us an email securely via\u00a0Protos Leaks<\/em><\/a>. For more informed news and investigations, follow us on\u00a0X<\/a>,\u00a0Bluesky<\/em><\/a>, and\u00a0Google News<\/em><\/a>, or subscribe to our\u00a0YouTube<\/em><\/a>\u00a0channel.<\/em><\/p>\n

The post Supra patched oracle on 11 other chains before $9M Hedera exploit<\/a> appeared first on Protos<\/a>.<\/p>","protected":false},"excerpt":{"rendered":"

A faulty oracle that caused a $9 million exploit over the weekend was patched on 11 chains in the days leading up to the attack, with the exploited Hedera deployment left vulnerable. The affected protocol, Bonzo Lend, explained that the oracle accepted an extreme mispricing of the attacker\u2019s collateral asset, which allowed them to borrow […]<\/p>\n","protected":false},"author":1,"featured_media":9234,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"rop_custom_images_group":[],"rop_custom_messages_group":[],"rop_publish_now":"initial","rop_publish_now_accounts":[],"rop_publish_now_history":[],"rop_publish_now_status":"pending","footnotes":""},"categories":[147],"tags":[],"class_list":["post-9233","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-invest"],"_links":{"self":[{"href":"https:\/\/handoli.com\/index.php\/wp-json\/wp\/v2\/posts\/9233","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/handoli.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/handoli.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/handoli.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/handoli.com\/index.php\/wp-json\/wp\/v2\/comments?post=9233"}],"version-history":[{"count":0,"href":"https:\/\/handoli.com\/index.php\/wp-json\/wp\/v2\/posts\/9233\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/handoli.com\/index.php\/wp-json\/wp\/v2\/media\/9234"}],"wp:attachment":[{"href":"https:\/\/handoli.com\/index.php\/wp-json\/wp\/v2\/media?parent=9233"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/handoli.com\/index.php\/wp-json\/wp\/v2\/categories?post=9233"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/handoli.com\/index.php\/wp-json\/wp\/v2\/tags?post=9233"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}