Thread by @sainteclectic

1/ At $50m The @CashioApp exploit was the 2nd largest heist on @solana & 13th largest hack overall. Despite this its been radio silence for hours.

@Saber_HQ have been working on it but have not been contacted by the exploiter.

Can anyone help? What we know & some thoughts🧵👇

2/ After the exploiter minted 2billion CASH they drained the CASH deposits of USDT & USDC ($26m) & swapped their remaining CASH tokens for ($25m) through @Saber_HQ crashing CASH's price to 0.

They now had~$50m of USDC/USDT/UST, $21m of which was swapped to ETH & wormholed to ETH

3/ All this was detailed by @0xavarek in this detailed thread:


The attacker's SOL wallet was funded by @sideshiftai a non-KYC dex who could potentially help but have been mostly silent on twitter.

4/ So what now?

The @CashioApp team's updates have been worryingly sporadic.

@Saber_HQ has been involved in the investigation too as they were in the process of investing in Cashio & heavily endorsed CASH on its platform.

They have been working with exchanges & law enforcement

5/ @Saber_HQ member Ian Macalinao personally audited the code & noted that the team did not audit Cashio as closely as they should have, having heavily endorsed them.

6/ @Saber_HQ is one of @solana's main defi protocols and a key building block for stables & liquidity. Most community members would not have been liquidity providing CASH had it not been one of the key tokens of the Saber platform, endorsed and audited.

7/ A great deal of people have been affected. Funds taken were their savings, money hard-earned & in some cases a large proportion of their livelihoods.

There has been no contact with the attacker, but hopefully we can find a solution that minimizes harm & suits all parties.

8/ Investors definitely bear the risk & learned hard lessons. Decentralization means these risks can have irreversible outcomes.

Still, it hits different when it happens to you. I have spent time speaking to victims and the anguish, mental impact & anxiety is crushing.

9/ Personally, I have been heavily affected by this, having moved a very large amount of borrowed stables into CASH-USDC to farm a few days back. It is all now lost. A painful lesson in risk management.

I am not a good place, but I hope we get some resolution regardless.

10/ For now some of @Saber_HQ's investors @RaceCapital (@maccanatron) @multicoincap (@KyleSamani) have helped put Saber in contact with those who can help but remained distanced which may be fair given they appear removed from Cashio.

Hopefully we can find a suitable outcome with the exploiter. There haven't been many updates or a post-mortem released yet but perhaps this is normal given the situation is fluid.

Ultimately the investors & community will likely have to bear responsibility of the risks taken.

But, failing any solution with the exploiter there is hope that @Saber_HQ & its backers would step in to help minimize the damage to investors / community & restore confidence in Solana's leading cross-chain stablecoin exchange.

It's just not a given.

@rajgokal @aeyakovenko @SOLBigBrain @rawrXBT @r0b0sapiens @monoliff @pit_the_panda @MateoNFT @DrRituximab @iamstephenyuan @alfonso_comino @socialcapital @chamath
@hcmonkey @kilosbtc @dvoretskyi @madmanix_NFT @Miles_NFT @knox_trades @0x1dad

@vladtoni @ApeddaddyRick @NFTjordy @0xOmniman @BeetleJuiceCB @0x1dad @Funksonait @ccclaytn @Mercury_Prime @PrimitiveMoney @earlyishadopter @banditopanchito @LtLollipop9 @RegenIncorp @sat_sa_ @rawrXBT @SolHannah77 @Nana_tradesSOL @digitalxmisfits @iamkadense

@TbohDegen @Michael45620417 @Infinito_nft @BeetleJuiceCB @DeusNero @harvey__nft @MilstGuga @Austin_Federa @MonterreyRice @LtLollipop9 @r0b0sapiens @RealCryptotem @blocmatesdotcom @boredgentlemen @MilstGuga @SollyTheIceApe @quincy_sol @consciousvalue @cited @e88_eth @TheOnlyNom

@fastdagod @chartfumonkey @IcedKnife @jemmmyjemm @rebeccagund @solnftradar @kylienft @notbunjil @tofushit888 @DegenSenpaii @inglishnft @ExiledApes