← Cashioreviewed 2026-11-02 · 15 claims checked
Fact-check findings
What an automated fact-checker found when it re-read Cashio against the sources the page cites. Only the most recent review is shown.
Read this first
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
disputed
2 claimsThe reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.
- #5[disputed][awaiting moderator]in section: The Exploit (March 23, 2022)
“the attacker obtained approximately $16.4 million in USDC and $10.8 million in USDT via LP token redemptions”
reviewerStolen funds: $16.4M USDC + $10.8M USDT via LP redemptions, plus $17M USDC + $8.6M USTRekt says the $10.8M was UST, not USDT. The same error recurs in sections[3]. Medium-confidence correction based on a single source.Proposed correction (not yet applied)the attacker obtained approximately $16.4 million in USDC and $10.8 million in UST via LP token redemptions - #6[disputed][awaiting moderator]in section: Scale of Damage
“The attacker obtained roughly $16.4 million in USDC and $10.8 million in USDT from LP token swaps on Saber”
reviewerSame USDT vs UST attribution in Scale of Damage sectionSame error as sections[1].Proposed correction (not yet applied)The attacker obtained roughly $16.4 million in USDC and $10.8 million in UST from LP token swaps on Saber
unverifiable
3 claimsNo source the reviewer could reach confirms or contradicts the claim.
- #3[unverifiable][awaiting moderator]in section: Fund Movement and Alleged Laundering
“Approximately $15.3 million in USDC and USDT were moved from Solana to Ethereum in three transactions.”
reviewerApprox. $15.3M USDC/USDT bridged via Jupiter and Wormhole in three transactions; over 16,000 ETH accumulatedRekt and CertiK do not give this figure. Other cited sources (Yahoo, AMBCrypto) were not fetched. The 16,000 ETH figure is supported by Rekt. - #4[unverifiable][awaiting moderator]in section: Fund Movement and Alleged Laundering
“the attacker subsequently transferred 1,610 ETH to an Ethereum mixer service across 17 transactions”
reviewerAttacker sent 1,610 ETH to a mixer in 17 transactionsAttributed to Etherscan data but not found in the sources I read. - #15[unverifiable][awaiting moderator]in the timeline
“Cashio announces plans on Medium for a new protocol to help victims; approximately $25 million in stolen funds remain unrecovered. Team goes silent on social media.”
reviewerTimeline: 2022-06 Cashio announced plans for a new protocol on Medium; team goes silentThe Medium announcement was not found in what I read. It also sits uneasily with sections[6], which says no relaunch plan was executed. The entry has no source.
partially supported
3 claimsThe cited evidence supports part of the claim but not all of it.
- #1[partially supported][awaiting moderator]in section: The Exploit (March 23, 2022)
“At approximately 08:15 UTC on March 23, 2022, an unknown attacker began exploiting Cashio's minter contract.”
reviewerExploit began at approximately 08:15 UTCSources differ (08:15 Rekt vs 8:23:26 CertiK); likely first setup transaction vs minting. The page uses both figures in different places without reconciling. - #2[partially supported][awaiting moderator]in the timeline
“Attacker exploits a missing collateral validation flaw in Cashio's smart contract at approximately 8:23 AM UTC, minting ~2 billion CASH tokens backed by worthless fake collateral and draining approximately $52 million in real assets.”
reviewerExploit occurred at approximately 8:23 AM UTC (inconsistent with the 08:15 UTC in the body)Supported by CertiK but internally inconsistent with the 08:15 UTC in sections[1]. Timeline entry has no source. - #9[partially supported][awaiting moderator]in the timeline
“Ian Macalinao, operating as 0xGhostchain, tells the Cashio Discord community 'I personally audited it,' a claim he later contradicts.”
reviewerIan Macalinao told Discord 'I personally audited it'; later contradictedStatement confirmed; the exact date 2021-11-23 was not verified. The entry has no source.
confirmed
7 claimsThe cited evidence supports the claim as written.
- #7[confirmed][no action needed]in section: The Exploit (March 23, 2022)
“Cashio developer 0xGhostchain issued a public warning on Twitter at 09:59 UTC — roughly 1 hour and 44 minutes after the attack began”
reviewerDeveloper warning at 09:59 UTC, about 1h44m after the attack beganMatches Rekt. - #8[confirmed][no action needed]in section: Scale of Damage
“Roughly $25 million of the stolen funds remained unrecovered as of mid-2022, per CertiK's incident analysis.”
reviewerAbout $25M of stolen funds unrecovered as of mid-2022 per CertiKCertiK URL as cited is the older path; it resolves to the /blog/ path. - #10[confirmed][no action needed]in the timeline
“Ian Macalinao writes (in an unpublished blog post) that Cashio's code was insecure because it was 'rushed for this deadline' and pledges to repay affected users from personal token holdings — a promise he does not fulfill.”
reviewerCode rushed for Breakpoint deadline; pledge to repay users from personal holdings, unfulfilledSubstance matches CoinDesk. The 2022-03-26 date was not verified. - #11[confirmed][no action needed]in section: Saber and Sunny Aggregator Connection
“CoinDesk's August 2022 investigation revealed that Ian Macalinao operated at least 11 pseudonymous developer identities”
reviewerIan Macalinao operated 11 pseudonymous identities; CoinDesk August 2022Confirmed. - #12[confirmed][no action needed]in section: Saber and Sunny Aggregator Connection
“In January 2023, CoinDesk reported that the U.S. Department of Justice had opened an investigation into Ian and Dylan Macalinao”
reviewerDOJ probe reported Jan 2023; brothers exited Protagonist VC and transferred control of some projects to MarinadeConfirmed. The page does not say who 'subsequently withdrew' beyond this, and 'no charges' is as of the investigation date, not verified to today. - #13[confirmed][no action needed]in section: The Attacker's On-Chain Messages and Alleged Partial Returns
“On-chain records showed hundreds of small USDC transactions distributed to addresses that had lost less than $100,000 in the attack”
reviewerHundreds of small USDC transactions to addresses that lost under $100kConsistent with Rekt. - #14[confirmed][no action needed]in section: Protocol Overview
“The protocol was never subjected to a third-party smart contract security audit.”
reviewerProtocol was never audited by a third partySupported by CoinDesk's account of Ian's own statement.
How this fits together. The reviewer reads the published page and its cited sources and records one finding per claim. A human moderator decides whether each proposed correction is applied; those decisions, and the score changes they cause, appear in the audit log. Earlier review runs are not shown here; only the latest reflects the page as it stands.