Cashio: the stablecoin that printed $2 billion of fake money
Cashio was a Solana stablecoin that printed 1 CASH for every real Saber USDC/USDT liquidity token you deposited. Its mint program ("Brrr") accepted the "Bank" and "collateral" accounts it was handed and never checked them against the real CASH mint - every single validation compared accounts to each other. The attacker built a fake account chain (a worthless LP token, a fake Bank, a fake Saber swap) that agreed with itself, passed all the checks, and minted 2,000,000,000 CASH from nothing. Then they redeemed and dumped it for ~$52.8M. No private key was ever stolen. The program simply verified the wrong thing.
Cashio was a stablecoin on Solana. Its token, CASH, was meant to always be worth $1. It launched in November 2021 under a developer known as 0xGhostChain. Unlike so-called 'algorithmic' stablecoins that back themselves with code and market games, CASH claimed to be fully collateralized - real dollars held in a pool should back every CASH.
It lets you turn real stablecoin liquidity into CASH and back. You deposit a Saber USDC/USDT liquidity-provider (LP) token - a token that already represents $1 of USDC + USDT quietly earning interest - and the protocol prints 1 CASH. Later you burn the CASH and get the LP token back. Deposit $1 of real backing, get 1 CASH. That is the entire promise.
The machinery lived in a Solana program nicknamed 'Brrr'. A special instruction called print_cash took a list of accounts - most importantly a 'Bank' account (the protocol's record of what collateral is valid) and a 'Collateral' account (the LP token you claim to have deposited) - and minted CASH against them. Because Solana programs cannot blindly trust the accounts they are handed, print_cash ran a series of assert_keys_eq! checks to make sure the accounts lined up before printing.
Everything rested on those checks actually proving the deposit was real. But spot the flaw: they only compared the accounts to each other, never to a fixed, trusted root like the genuine CASH mint. On Solana you control the transaction you submit - so you can supply the Bank, the Collateral, and the swap accounts yourself. If every check is 'does A match B' and you made both A and B, the checks pass every time. A 'stablecoin' is only as real as its collateral check.
A stablecoin earns its $1 peg one way: someone deposits real value, and the protocol prints the coin against it.
Cashio worked like this:
- You deposit a Saber USDC/USDT LP token. That token already represents $1 of real, yield-bearing stablecoin backing.
- You receive 1 CASH. Burn CASH, get the LP token back.
The logic lived in a program called Brrr. Its print_cash instruction took a list of accounts and minted CASH. Two of those accounts mattered most:
- the Bank account - the protocol's own record describing which collateral is valid, and
- the Collateral / Arrow account - the LP token you claim to have deposited.
On Solana a program cannot trust the accounts it is handed; it has to check them. Brrr did check - it ran a chain of assert_keys_eq! tests. But here is the fatal detail: every check compared two accounts the caller supplied, to each other. Nothing was ever compared to a fixed, trusted root - not the real CASH mint, not the protocol's genuine Bank account.
Picture a bouncer who only checks that the photo on your ID matches your face, and never checks that the ID itself is real. Forge your own ID and you match every time.
The break:
1. The attacker created their own worthless LP token mint and used init_arrow_vendor_miner to mint 2,000,000,000 fake LP tokens to themselves.
2. They built a fake Bank, a fake Collateral, and a fake Saber swap account - all pointing at their fake token and referencing each other.
3. They called print_cash with that forged chain. Each assert_keys_eq! compared one attacker-made account to another attacker-made account. They all matched. The checks passed.
4. print_cash minted 2,000,000,000 real CASH - against collateral worth nothing.
5. The new CASH was indistinguishable from real money. The attacker redeemed part of it for the pool's genuine USDC/USDT backing (~$27.2M) and sold the rest on decentralized exchanges (~$25.6M), then shuttled the proceeds off Solana through the Jupiter aggregator and the Wormhole bridge and converted them to ETH.
The fix: anchor the validation to reality - confirm that the collateral's backing mint (the crate_mint) is the real CASH mint, rather than an account the caller supplied. One comparison against a trusted root would have rejected the entire forged chain. The lesson: assert_keys_eq!(a, b) proves nothing about safety when the attacker controls both a and b.
You are the detective. Someone moved money that was not theirs, and all you have is a public blockchain and a few free websites. The five moves below are the same routine professional investigators run on almost any exploit - bridges, oracles, rug pulls. No coding required, just curiosity.
Skepticism first: a headline sells the story, not the facts. 'A stablecoin printed $2 billion of fake money' tells you almost nothing by itself. Pin down WHAT moved, WHEN, and WHICH account touched it - then ask the real question: what was supposed to stop this?
Do thisOpen Cashio's official warning next to the CASH token page on Solscan. Write down the exact date/time in UTC, the asset, and the chain involved.
Look forThe word that reframes everything: 'mint'. A stablecoin can only print CASH against real collateral - so the whole case becomes: how did fake collateral pass the check?
In this caseCashio, March 23 2022. 2,000,000,000 CASH were MINTED, not stolen from a wallet. That one word points straight at the minting program's collateral validation.
Cashio X postSolscan
Cashio launches on Solana. CASH pegs to $1, minted against Saber USDC/USDT LP tokens. The project is never given a third-party audit before launch.
CASH grows to hold roughly $28.9M of collateral. Users trust the peg and the 'fully collateralized' claim without any independent review of the mint code.
The attacker creates a worthless LP token mint and, via `init_arrow_vendor_miner`, mints 2,000,000,000 fake LP tokens. They assemble a forged Bank / Collateral / Saber-swap account chain that references only itself.
The attacker calls `print_cash` with the forged accounts. Every validation check compares attacker-supplied accounts to each other, so all pass - and 2,000,000,000 CASH are minted from nothing.
Cashio and developer 0xGhostChain publicly warn users: 'There is an infinite mint glitch. Please withdraw your funds from pools.' The run on the peg begins.
The attacker redeems CASH for the pool's real collateral (~$27.2M) and dumps the rest on decentralized exchanges (~$25.6M), moving funds off Solana via Jupiter and the Wormhole bridge and converting to ETH.
CASH collapses from $1 to about $0.00005. Cashio's TVL falls from $28.87M to roughly $569K in a single day.
The attacker posts on-chain claiming they only meant to take from those who did not need the money. Accounts under ~$100k are partially refunded; the attacker refuses to return funds to 'rich Americans and Europeans' and invites victims to justify their own assets.
Cashio never restarts. Roughly $25M is never returned. The attacker is never publicly identified or charged. The team had engaged an audit firm only after the exploit, when it was far too late.
The mint accepted caller-supplied 'Bank' and 'collateral' accounts with no anchor to a known-good root (the real CASH mint) - the entire attack in one sentence.
Every validation was an assert_keys_eq! comparing two caller-supplied accounts to each other. When an attacker controls both sides of a comparison, the check proves nothing.
One instruction could mint 2,000,000,000 tokens - unlimited mint with no per-user cap or secondary confirmation.
The project was never third-party audited before launch, yet marketed as a 'fully collateralized' stablecoin. 'Collateralized' is a claim about code, not a slogan.
Users trusted the $1 peg without checking whether the mint path was actually tied to real collateral - the one thing that made the peg meaningful.
The blast radius extended beyond Cashio: Saber's CASH pools ate much of the dump, showing how one broken protocol drains its neighbors.
Replay the attack
Print 2B CASH from a fake receipt
Cashio (CASH) should only mint 1 CASH for every real dollar of backing. It minted instead because its 9 validation checks only compared accounts you supplied to each other - so a forged chain passed them all. Toggle the one-line fix, then print 2B CASH from nothing. 100% simulated.
A stablecoin like Cashio (CASH) keeps its $1 peg the old-fashioned way: you deposit real value, it prints the coin against it. Here the deposit is a Saber USD LP token - a token that already represents $1 of USDC + USDT earning interest. Deposit one, get one CASH. The whole machine trusts one thing: that you really did hand over the collateral. An auditor's job is to ask: how does the program prove that?