Cashio hack — March 2022

Cashio was a Solana stablecoin protocol that minted CASH against deposits of Saber liquidity-provider tokens. On 23 March 2022 an attacker minted two billion CASH out of nothing and cashed it out, collapsing the token from its dollar peg to a fraction of a cent within hours.

The bug was missing account validation. Cashio's minting program did not check the mint field on the saber_swap.arrow account it was handed, and did not verify that the token associated with the collateral bank matched the one being minted. That allowed the attacker to construct forged Crate and Arrow accounts, present worthless tokens as valid collateral, and mint CASH without limit. Halborn notes the project was unaudited. A developer using the handle 0xGhostChain warned users not to mint CASH and to withdraw from pools.

Estimates of the take vary widely and measure different things. DeFiLlama-based figures cited by Decrypt put the drain at about $28 million, which reflects Cashio's own locked value falling from roughly $28.9 million to about $569,000. Samczsun of Paradigm put it at around $50 million on the day, describing it as based on a quick skim. The Block reported $52.8 million, itemised as $27.2 million of collateral redeemed from Cashio plus $25.6 million of CASH sold into decentralised exchange pools; Halborn says over $52 million. The gap arises because much of the loss fell on Saber's CASH liquidity pools rather than on Cashio's vault.

The attacker later posted on-chain that they had intended to take money only from those who did not need it, said funds would not be refunded to rich Americans and Europeans, and invited affected users to explain the source of their assets and why their money should be returned. Cashio never restarted and no one has been charged.