Cashio Hack 2022 — $52M Exploit Analysis

Infinite mint exploit on Solana stablecoin protocol Cashio drained $52M by exploiting faulty account validation logic.

Details

• Date: 2022-03-23
• Amount Lost: $52,300,000
• Chain(s): Solana
• Category: DeFi
• Technique: Smart Contract Exploit
• Status: Laundered
• Amount Recovered: None reported

Full Description

Cashio's CASH stablecoin protocol failed to properly validate the 'crate_collateral_tokens' account in its Arrow program. An attacker created fake accounts that passed validation checks and minted an unlimited supply of CASH tokens backed by nothing, then redeemed them for all available collateral in the protocol.

Laundering Analysis

Stolen funds (USDC, USDT) moved through multiple Solana wallets. Portions bridged to Ethereum via Wormhole and mixed via Tornado Cash. Cashio team and Solana community tracked fund flows. Attacker left an on-chain message claiming to target only wallets with over $100K, donating remaining to charity — unverified.

Sources

• https://rekt.news/cashio-rekt/
• https://medium.com/crema-finance/cashio-post-mortem-6a21b8f27e2f

Transaction Hashes

• 3sZnL6MRV5GkQqB9TWzWjvQJ9DTSSXkQxCuTBKNpBXVEuLBKK3wBrAHAPfaKJxCiVJ6RRxBY6RWiB1LzqPnM2a3

Related Hacks

• Euler Finance — 2023-03-13 — $197M
• Beanstalk Farms — 2022-04-17 — $182M
• Wintermute — 2022-09-20 — $160M
• Cream Finance — 2021-10-27 — $130M
• Compound — 2021-09-30 — $80M

Back to Browse