Cashio's infinite-mint bug arose from two missing account-validation checks in the collateral deposit path, letting attackers use fake tokens as Saber LP collateral. ~2 billion CASH were minted and swapped for ~$52.8M in USDC, USDT and UST; CASH crashed to $0.00005.

The stablecoin project Cashio on Solana has been hacked. According to the preliminary analysis of the SlowMist security team, hackers illegally issued 2 billion CASH tokens by bypassing an unverified account, and converted CASH tokens into 8,646,022.04 UST, 17,041,006.5 USDC and 26,340,965.68 USDT-USDC through multiple applications. LP, total profit value: 52027994.22 USD (more than 50 million USD). At present, the official announcement has been issued to allow users to suspend the use of the contract, and a temporary patch has been released to fix the vulnerability.