Learn from other people's money.
Every case below is a real Solana exploit, reconstructed from the on-chain evidence and public filings. You will see the wallets, the transactions, the mistakes - and the exact research method investigators used to trace it all. This is the skill nobody teaches: how to read a chain like a detective.
The Case Files
Mango Markets: the $114M oracle squeeze
In under an hour, a trader used two anonymous accounts and roughly $10M of his own capital to pump the price of a thinly traded governance token, MNGO, on the exchanges that fed Mango Markets' oracle. The protocol trusted that fake price, valued his unrealized perp profits at hundreds of millions, and let him borrow out almost every real asset in the vault. There was no code bug. Every transaction was valid. He just lied to the price feed - and the risk engine believed it.
Wormhole: the $326M shortcut past the guardians
Wormhole's Solana bridge verified messages with a 13-of-19 'guardian' signature check. The catch: the program did not do the expensive signature math itself - it read the result from a *prior instruction* in the same transaction, trusting the system-provided 'instructions' account. The attacker passed a fake version of that account, filled it with a forged 'signatures are valid' instruction, and the program believed the guardians had approved a 120,000 ETH deposit that never happened. It minted 120,000 wETH from nothing, then bridged it to Ethereum. No key was stolen. The program simply verified the wrong thing.
Cashio: the stablecoin that printed $2 billion of fake money
Cashio was a Solana stablecoin that printed 1 CASH for every real Saber USDC/USDT liquidity token you deposited. Its mint program ("Brrr") accepted the "Bank" and "collateral" accounts it was handed and never checked them against the *real* CASH mint - every single validation compared accounts to each other. The attacker built a fake account chain (a worthless LP token, a fake Bank, a fake Saber swap) that agreed with itself, passed all the checks, and minted **2,000,000,000 CASH** from nothing. Then they redeemed and dumped it for ~$52.8M. No private key was ever stolen. The program simply verified the wrong thing.
More cases land here as we trace them - bridges, stablecoin depegs, audit failures and rug pulls. Each one replays the real numbers in the matching sandbox lab.