The Infinite Money Glitch Actually Exists

Our last post was about stablecoins. This post is about what can go wrong with stablecoins.

Cashio is a stablecoin on the solana network. It's pegged to the US Dollar and the idea is that one Cashio token should always be worth 1 USD (although the price is far, far, below that now). 

The hack

Hackers exploited an "infinite mint glitch". Minting Cashio is the process of generating new Cashio coins. Usually, to mint Cashio, the rule was that you had to post collateral worth $1. These hackers found a bug which allowed them to mint new Cashio tokens, without posting any collateral. So what they did is they minted as many as they could, and then exchanged these tokens for other stablecoins like USDC and USDT, which they knew were more secure and had value. 

By doing this, the hackers managed to steal $52.8 million, and the price of the Cashio stablecoin plummeted from $1 to $0.00005. 

Then, the hacker decided they wanted to be some crypto robin hood. They declared that they would give the stolen money back, but only to those who had less than $100,000 in their account. They then claimed that the rest of the money would go to charity. This claim is worthless because there is no way to verify this. 

Not the first Infinite Mint Glitch

A group of developers found a similar bug in the DeFi insurance project COVER, in December 2020. They minted fake tokens and were able to exchange these for real COVER tokens. After this, they sold their COVER tokens for a profit. The attackers managed to get $3 million, but they (allegedly) sent it all back along with this tweet - which was pretty goddamn gangster if you ask me.

Stable?Coins

Cashio's story is very important, because it drives home the lesson that stablecoins aren't always stable. There is a lot of skepticism around stablecoins in general, and that's a problem. Because they are key to the whole crypto ecosystem. This is all a learning process and Cashio say they have now fixed the bug that led to this hack. We're still yet to see if the price of Cashio can recover, or if this project is going to end up dead because of this hack. Even if it's too late for Cashio, this whole episode provided lessons for the crypto ecosystem as a whole.