On July 23, 2026, Solido Cash's CDP suffered an oracle attack when the SOLID price feed went stale and fell back to near-par CASH valuation (0.99919999) while SOLID was trading at 22.2 SUPRA per unit. An attacker looped acquire-collateral, mint-CASH, sell-CASH twice across 18:21 UTC and 21:12 UTC transactions, minting 809,052 CASH of unbacked debt and selling it for 293.7M SUPRA.

Solido Cash (the largest DeFi protocol on Supra) was exploited due to an oracle misassignment on SOLID collateral (stale feed fallback to CASH oracle, severely overvaluing collateral). The attacker, in two waves (one atomic tx + one multi-wallet manual), deposited cheap collateral, minted excess CASH, and sold it on DEXs for SUPRA, netting ~293.7M SUPRA. No user funds were affected; losses primarily hit LPs (mostly the foundation) and protocol reserves. The protocol paused relevant functions and released a forensic report.