Stablecoin Cashio Suffers 'Infinite Glitch' Exploit, TVL Drops by $28M

Solana-based stablecoin protocol Cashio was exploited in an “infinite glitch” attack, developers said on Wednesday.

• Following the exploit, the value of Cashio's CASH token dropped to nearly zero.
• “Please do not mint any CASH. There is an infinite mint glitch. We are investigating the issue and we believe we have found the root cause. Please withdraw your funds from pools,” the team wrote in a tweet.

• CASH is a stablecoin pegged to the U.S .dollar and is backed by USDC and USDT via a liquidity pool on Saber, a Solana-based market maker. Users can mint their CASH by providing liquidity with USDT and USDC.
• The incident on Wednesday allowed the hacker to manipulate Cashio’s smart contracts to mint an infinite supply of CASH without providing any liquidity in return. Blockchain data shows over 2 billion CASH were minted, without any USDC or USDT backing.
• The hacker used the newly minted tokens to exchange them for stablecoins on Cashio’s liquidity pools. Data from tracking tool DeFiLlama shows the total value locked on Cashio dropped by $28 million after the attack.
• Stablecoins based on other protocols has suffered similar attacks in the past. Polygon-based Safedollar dropped to $0 after an exploit in June 2021, with both USDC and USDT siphoned off by the hacker at the time.