Audit log

Every state-changing event for Cashio: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-05-19 20:04:08Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 420,837,875

   sig

   3yruQw583pRq…xntSsxZHcopyexplorer ↗

   hash

   EZvD1i5Qm5E4…korfcAk8copysha256 → base58

   verifying row…full verify ↗

   canonical bytes (6798 B) ▸

   {"actor":"system:backfill","investigation_id":"2098c3c5-0cdc-4c96-a8bf-cadb693e915a","kind":"publish","page_slug":"cashio","published_at":"2026-05-19T20:04:07.967Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Cashio","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.coindesk.com/layer2/2022/08/04/master-of-anons-how-a-crypto-developer-faked-a-defi-ecosystem"},{"credibility":3,"name":"","type":"other","url":"https://www.coindesk.com/tech/2022/03/23/stablecoin-cashio-suffers-infinite-glitch-exploit-tvl-drops-by-28m"},{"credibility":3,"name":"","type":"other","url":"https://www.halborn.com/blog/post/explained-the-cashio-hack-march-2022"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.halborn.com/blog/post/explained-the-cashio-hack-march-2022"},{"credibility":3,"name":"","type":"other","url":"https://www.certik.com/resources/blog/cashio-app-incident-analysis"},{"credibility":3,"name":"","type":"other","url":"https://ackee.xyz/blog/2022-solana-hacks-explained-cashio/"},{"credibility":3,"name":"","type":"other","url":"https://beincrypto.com/solana-fake-account-exploit-on-cashio-how-it-happened/"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.certik.com/resources/blog/cashio-app-incident-analysis"},{"credibility":3,"name":"","type":"other","url":"https://cryptobriefing.com/millions-lost-as-solana-defi-app-cashio-suffers-hack/"},{"credibility":3,"name":"","type":"other","url":"https://www.quadrigainitiative.com/casestudy/cashioappsolanafakeaccountexploit.php"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.coindesk.com/layer2/2022/08/04/master-of-anons-how-a-crypto-developer-faked-a-defi-ecosystem"},{"credibility":3,"name":"","type":"other","url":"https://www.nasdaq.com/articles/the-fake-team-that-made-solana-defi-look-huge"},{"credibility":3,"name":"","type":"other","url":"https://www.cryptotimes.io/2022/08/05/founders-revealed-to-pump-tvl-on-solana-launch-sybil-attack/"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.halborn.com/blog/post/explained-the-cashio-hack-march-2022"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://fortune.com/2022/03/25/crypto-robin-hood-stole-50-million-hacker-heist-cashio/"},{"credibility":3,"name":"","type":"other","url":"https://www.web3isgoinggreat.com/?id=robin-hood-esque-attacker-steals-52-million-from-cashio-then-returns-smaller-amounts-and-pledges-to-donate-the-rest-to-charity"},{"credibility":3,"name":"","type":"other","url":"https://thedefiant.io/news/hacks/cashio-exploit-refund"},{"credibility":3,"name":"","type":"other","url":"https://fortune.com/2022/03/31/crypto-robin-hood-50-million-theft-apply-and-get-a-refund-hacker-cashio/"},{"credibility":3,"name":"","type":"other","url":"https://solananewstoday.com/2022/03/28/the-cashio-vulnerability-against-saber-and-our-users-what-happened-and-what-we-are-doing-about-it/"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.halborn.com/blog/post/explained-the-cashio-hack-march-2022"},{"credibility":3,"name":"","type":"other","url":"https://www.certik.com/resources/blog/cashio-app-incident-analysis"},{"credibility":3,"name":"","type":"other","url":"https://www.coindesk.com/layer2/2022/08/04/master-of-anons-how-a-crypto-developer-faked-a-defi-ecosystem"},{"credibility":3,"name":"","type":"other","url":"https://www.vidma.io/blog/the-cashio-hack-lessons-from-a-48-million-defi-exploit"}]}],"sources_used":[],"summary":"Cashio was a Solana-based algorithmic stablecoin protocol that issued the CASH token, collateralized by Saber LP tokens. On March 23, 2022, an attacker exploited a critical missing validation flaw in the smart contract to mint approximately 2 billion CASH tokens backed by worthless fake collateral, draining roughly $52 million in real assets and permanently destroying the token's USD peg. The protocol was unaudited, never compensated victims in full, and its pseudonymous creator later admitted the code was rushed and insecure.","timeline":[{"date":"2021-11-23","event":"Ian Macalinao, operating as 0xGhostchain, tells the Cashio Discord community 'I personally audited it,' a claim he later contradicts.","source":""},{"date":"2021-11-01","event":"Cashio is launched on Solana, built by Ian Macalinao under the pseudonym 0xGhostchain, as part of an ecosystem of protocols around the Saber DEX. The code was reportedly rushed to meet a Breakpoint conference deadline.","source":""},{"date":"2022-03-23","event":"Attacker exploits a missing collateral validation flaw in Cashio's smart contract at approximately 8:23 AM UTC, minting ~2 billion CASH tokens backed by worthless fake collateral and draining approximately $52 million in real assets. CASH token collapses to near zero.","source":""},{"date":"2022-03-23","event":"Attacker embeds on-chain message: 'Account with less 100k have been returned. all other money will be donated to charity.' Saber pauses withdrawals to Cashio pools and freezes smart contracts.","source":""},{"date":"2022-03-23","event":"Ian Macalinao publicly acknowledges 'I did not audit Cashio as carefully as I should have,' contradicting prior claims.","source":""},{"date":"2022-03-26","event":"Ian Macalinao writes (in an unpublished blog post) that Cashio's code was insecure because it was 'rushed for this deadline' and pledges to repay affected users from personal token holdings — a promise he does not fulfill.","source":""},{"date":"2022-03-28","event":"Attacker posts second message stating intention was to redistribute wealth and invites victims with over $100,000 in losses to apply for refunds. Saber team states they cannot compensate depositors.","source":""},{"date":"2022-03-31","event":"Attacker opens a refund application process requiring victims to explain why they need their money back; large accounts held by wealthy individuals are excluded from consideration.","source":""},{"date":"2022-06-01","event":"Cashio announces plans on Medium for a new protocol to help victims; approximately $25 million in stolen funds remain unrecovered. Team goes silent on social media.","source":""},{"date":"2022-08-04","event":"CoinDesk publishes 'Master of Anons,' revealing that Ian and Dylan Macalinao operated 11 fake developer identities to inflate Solana DeFi TVL, with Cashio (via 0xGhostchain) being one of those projects.","source":""}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 079f0cb8-6934-4bf6-bacf-8a86e2246fdfcopy
2. #2reviewby reviewerreviewer

   2026-11-02 04:17:00Z
   Score: 5 → 5 (no score change)
   The core narrative (infinite-mint exploit on 2022-03-23, about $52M lost, Ian Macalinao behind the 0xGhostchain pseudonym, the CoinDesk pseudonym investigation, a reported DOJ probe) is supported by Rekt, CertiK and CoinDesk. Defects: $10.8M is labeled USDT where Rekt says UST (twice); the attack time is given as 08:15 in the body and 8:23 in the timeline; the laundering specifics ($15.3M in three transactions, 1,610 ETH to a mixer in 17 transactions) were not found in the sources read; the June 2022 Medium announcement is unsupported. No shutdown omission: the page states the protocol collapsed.
   anchoranchored

   chain

   ●mainnet-betaslot 464,357,779

   sig

   3j4qPKucaq76…ESYB1Qgvcopyexplorer ↗

   hash

   AQJCtFHu6sJX…XBHh7A1Zcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1447 B) ▸

   {"actor":"reviewer","artifact_identity":"137564cb3cdd151ed3a11f5f88c2f64a","decided_at":"2026-11-02T04:16:59.955Z","decision":"review","disputed_pct":0.3333,"findings_hash":"2cEnJuc3CfcG5eGYPzhQZHNZ3sdMe6BRDDviAemvyiHr","investigation_id":"2098c3c5-0cdc-4c96-a8bf-cadb693e915a","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":5,"omissions":{"material":0,"total":1},"page_content_hash":"c8a975f9274619b7f7590b69e812103ead41872857d8a905514d97c42879b348","page_slug":"cashio","prev_score":5,"reason":"The core narrative (infinite-mint exploit on 2022-03-23, about $52M lost, Ian Macalinao behind the 0xGhostchain pseudonym, the CoinDesk pseudonym investigation, a reported DOJ probe) is supported by Rekt, CertiK and CoinDesk. Defects: $10.8M is labeled USDT where Rekt says UST (twice); the attack time is given as 08:15 in the body and 8:23 in the timeline; the laundering specifics ($15.3M in three transactions, 1,610 ETH to a mixer in 17 transactions) were not found in the sources read; the June 2022 Medium announcement is unsupported. No shutdown omission: the page states the protocol collapsed.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":0,"sequence_num":2,"subject_status":"shut_down","subject_status_contradicts_page":false,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 2c0ae647-ac15-4b64-9721-3beead23630ecopy
3. #3review reviseby judgejudge

   2026-11-02 04:17:00Z
   Score: 5 → 0 (-15)
   Of 15 reviewed claims, 2 were disputed and 3 could not be verified, giving a 33% disputed-or-unverifiable rate, which falls in the significant-issues band. The disputed items are the same error repeated twice: $10.8M is labeled USDT where Rekt says UST (claim_findings[4] and [5]). The unverifiable items are the laundering specifics ($15.3M in three transactions, 1,610 ETH to a mixer in 17 transactions) and the June 2022 Medium announcement (claim_findings[2], [3], [14]). The core narrative (the March 2022 exploit, about $52M lost, the CoinDesk pseudonym investigation and the reported DOJ probe) is supported by Tier 1 and Tier 2 sources, so the penalty sits at the low end of the band. The attack time is also given inconsistently as 08:15 and 08:23 UTC (claim_findings[0] and [1]), and no timeline entry has a source.
   anchoranchored

   chain

   ●mainnet-betaslot 464,357,784

   sig

   PwaEmn3injEr…eUv2DTvJcopyexplorer ↗

   hash

   8xjN4Yh5BNQa…Jvst5CKxcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1465 B) ▸

   {"actor":"judge","artifact_identity":"137564cb3cdd151ed3a11f5f88c2f64a","band_override":null,"decided_at":"2026-11-02T04:16:59.955Z","decision":"review_revise","delist_requested":false,"disputed_pct":0.3333,"investigation_id":"2098c3c5-0cdc-4c96-a8bf-cadb693e915a","judge_def_hash":"8800307026131ea9d5da939d32b9a1f1884b2b84a5de33c8e87931d36f38d0f8","new_score":0,"page_slug":"cashio","prev_score":5,"reason":"Of 15 reviewed claims, 2 were disputed and 3 could not be verified, giving a 33% disputed-or-unverifiable rate, which falls in the significant-issues band. The disputed items are the same error repeated twice: $10.8M is labeled USDT where Rekt says UST (claim_findings[4] and [5]). The unverifiable items are the laundering specifics ($15.3M in three transactions, 1,610 ETH to a mixer in 17 transactions) and the June 2022 Medium announcement (claim_findings[2], [3], [14]). The core narrative (the March 2022 exploit, about $52M lost, the CoinDesk pseudonym investigation and the reported DOJ probe) is supported by Tier 1 and Tier 2 sources, so the penalty sits at the low end of the band. The attack time is also given inconsistently as 08:15 and 08:23 UTC (claim_findings[0] and [1]), and no timeline entry has a source.","reviewer_def_hash":"bc11388ce4bc4deea1b064fea362663ae06e3f4f687f99604769044d6ffba770","score_delta":-15,"sequence_num":3,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision d03a1b55-8a4c-4b42-8b8f-a11ac61193eccopy