Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·3yruQw…sxZHSummary
Cashio was a Solana-based algorithmic stablecoin protocol that issued the CASH token, collateralized by Saber LP tokens. On March 23, 2022, an attacker exploited a critical missing validation flaw in the smart contract to mint approximately 2 billion CASH tokens backed by worthless fake collateral, draining roughly $52 million in real assets and permanently destroying the token's USD peg. The protocol was unaudited, never compensated victims in full, and its pseudonymous creator later admitted the code was rushed and insecure.
Connected Entities
5 entities · 60 linked investigations- Cashio→mentioned with→Solana(80%)
- Cashio→mentioned with→Ethereum(70%)
- Cashio→mentioned with→Wormhole(60%)
- Cashio→mentioned with→Jupiter Exchange(60%)
- Wormhole→mentioned with→Solana(80%)
- Wormhole→mentioned with→Ethereum(70%)
- Jupiter Exchange→mentioned with→Solana(80%)
- Jupiter Exchange→mentioned with→Ethereum(60%)
- Solana→mentioned with→Ethereum(60%)
Timeline(10 events)
23 November 2021
Ian Macalinao, operating as 0xGhostchain, tells the Cashio Discord community 'I personally audited it,' a claim he later contradicts.
November 2021
Cashio is launched on Solana, built by Ian Macalinao under the pseudonym 0xGhostchain, as part of an ecosystem of protocols around the Saber DEX. The code was reportedly rushed to meet a Breakpoint conference deadline.
23 March 2022
Attacker exploits a missing collateral validation flaw in Cashio's smart contract at approximately 8:23 AM UTC, minting ~2 billion CASH tokens backed by worthless fake collateral and draining approximately $52 million in real assets. CASH token collapses to near zero.
23 March 2022
Attacker embeds on-chain message: 'Account with less 100k have been returned. all other money will be donated to charity.' Saber pauses withdrawals to Cashio pools and freezes smart contracts.
23 March 2022
Ian Macalinao publicly acknowledges 'I did not audit Cashio as carefully as I should have,' contradicting prior claims.
26 March 2022
Ian Macalinao writes (in an unpublished blog post) that Cashio's code was insecure because it was 'rushed for this deadline' and pledges to repay affected users from personal token holdings — a promise he does not fulfill.
28 March 2022
Attacker posts second message stating intention was to redistribute wealth and invites victims with over $100,000 in losses to apply for refunds. Saber team states they cannot compensate depositors.
31 March 2022
Attacker opens a refund application process requiring victims to explain why they need their money back; large accounts held by wealthy individuals are excluded from consideration.
June 2022
Cashio announces plans on Medium for a new protocol to help victims; approximately $25 million in stolen funds remain unrecovered. Team goes silent on social media.
4 August 2022
CoinDesk publishes 'Master of Anons,' revealing that Ian and Dylan Macalinao operated 11 fake developer identities to inflate Solana DeFi TVL, with Cashio (via 0xGhostchain) being one of those projects.
Decision Log
- hash: EZvD1i5Qm5E4ZjdQ2yfR8SAXfnXgbR9nb3o8korfcAk8
This investigation is cryptographically anchored to the Solana blockchain (1 event). 18 of 23 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 5/4/2026, 2:54:50 AM
last updated: 8/30/2026, 8:24:59 AM
7 viewsavoid.net — verified advice for a post-truth world