Cashio (CASH)
A Solana stablecoin drained of about $52.8M on March 23, 2022 via an 'infinite mint' bug: missing collateral-validation let an attacker mint ~2B CASH with worthless tokens, collapsing the peg to near zero. The attacker left a message saying small accounts were refunded.
Also known as: Cashio, Cashio App, CASH
Summary
Cashio was a Solana-based stablecoin (CASH) backed by Saber USD liquidity-provider tokens. On March 23, 2022, an attacker exploited an "infinite mint" vulnerability — the protocol failed to fully validate that deposited collateral was genuine — to mint about 2 billion CASH using worthless fake-account tokens, then redeemed and swapped them for roughly $52.8 million in USDC, USDT, and UST. [1][2]
Aftermath
The CASH peg collapsed from $1 to about $0.00005. The attacker embedded an on-chain message stating that accounts holding under $100,000 had been refunded and that the rest would be "donated to charity." Analyses noted Cashio had not undergone a third-party audit. [1][2]
Bracketed numbers refer to the numbered sources listed below.
Linked scams & cases
- Iron Finance (TITAN)RelatedTokensA partially collateralized stablecoin protocol on Polygon whose share token TITAN collapsed from ~$64 to near zero on June 16, 2021 in what the team called crypto's 'first large-scale bank run.' Its TVL fell from ~$2B; investor Mark Cuban said he was among those hit.
- Solana 'Validator Rewards' GiveawayRelatedOtherImpersonation + giveaway scam using a fake Solana Foundation account to solicit SOL for '2x rewards'.
Sources (2)
- Cashio App Incident Analysis — CertiK
- Explained: The Cashio Hack (March 2022) — Halborn
See also
Gala Games exploitTokensOn May 20, 2024 an attacker abused a privileged minter account on the GALA token contract to mint 5 billion GALA (≈$200M+ nominal) and dumped ~600M of them for ~$22M of ETH before Gala froze the address. Gala Games called it an internal access-control failure; the attacker later returned the ~$22M.
HEX / PulseChain (Richard Heart)ProjectsCrypto projects (HEX, PulseChain, PulseX) created by Richard Heart (Richard Schueler). In July 2023 the U.S. SEC sued him for offering unregistered securities that raised $1B+ and for allegedly misappropriating ~$12M for luxury goods (including a 555-carat diamond). A court dismissed the case in 2024 for lack of U.S. jurisdiction; there was no finding of wrongdoing and Heart denies the allegations.
This page was last updated on Jun 15, 2026. View revision history.
