Cashio (CASH)
A Solana stablecoin drained of about $52.8M on March 23, 2022 via an 'infinite mint' bug: missing collateral-validation let an attacker mint ~2B CASH with worthless tokens, collapsing the peg to near zero. The attacker left a message saying small accounts were refunded.
Also known as: Cashio, Cashio App, CASH
Summary
Cashio was a Solana-based stablecoin (CASH) backed by Saber USD liquidity-provider tokens. On March 23, 2022, an attacker exploited an "infinite mint" vulnerability — the protocol failed to fully validate that deposited collateral was genuine — to mint about 2 billion CASH using worthless fake-account tokens, then redeemed and swapped them for roughly $52.8 million in USDC, USDT, and UST. [1][2]
Aftermath
The CASH peg collapsed from $1 to about $0.00005. The attacker embedded an on-chain message stating that accounts holding under $100,000 had been refunded and that the rest would be "donated to charity." Analyses noted Cashio had not undergone a third-party audit. [1][2]
Bracketed numbers refer to the numbered sources listed below.
Linked scams & cases
- Iron Finance (TITAN)RelatedTokensA partially collateralized stablecoin protocol on Polygon whose share token TITAN collapsed from ~$64 to near zero on June 16, 2021 in what the team called crypto's 'first large-scale bank run.' Its TVL fell from ~$2B; investor Mark Cuban said he was among those hit.
- Solana 'Validator Rewards' GiveawayRelatedSocial accountsImpersonation + giveaway scam using a fake Solana Foundation account to solicit SOL for '2x rewards'.
People & entities involved
Sources (2)
- Cashio App Incident Analysis — CertiK
- Explained: The Cashio Hack (March 2022) — Halborn
See also
- Bitcoin Latinum (LTNM)TokensA ~$16M token offering (SAFTs for 'Bitcoin Latinum' / LTNM) that the SEC charged in 2026 as fraud: founder Donald Basile falsely called LTNM 'the world's first insured digital asset' backed by an 'existing trust,' neither of which existed, and diverted investor funds for personal use (including a $160,000 horse).
- Loci (LOCIcoin)TokensA 2017–2018 ICO for 'LOCIcoin' tied to the InnVenn IP-search platform. The SEC charged Loci and CEO John Wise with fraud for raising $7.6M on false claims about revenue, headcount, and user base; Wise also misused investor funds. Settled with a $7.6M penalty and an officer/director bar.
- Blockchain Terminal (BCT)Tokens
This page was last updated on Jun 8, 2026. View revision history.