.png){kind=logo}
Solido Money has reported a major exploit involving 293.7 million SUPRA tokens after attackers abused a pricing error in its Solido Cash protocol. Incident records place the stolen amount near $900,000 when the attack occurred on July 23, 2026.
PeckShield said ‘about 90%’ of the affected tokens reportedly belonged to the Solido Foundation. The loss adds pressure to the project as its locked value falls below $1 million and SUPRA trades near historic lows.
Solido’s forensic review linked the breach to an oracle misassignment involving SOLID, a token used as backstop collateral. A stale price feed triggered fallback logic that valued SOLID far above its actual market price.
The attacker used the inflated collateral value to mint CASH without enough backing. The newly created CASH was then exchanged for SUPRA, allowing the attacker to remove tokens from trading pools.
The first wave began at 18:21 UTC and used one transaction to swap tokens, deposit collateral, mint CASH, and sell it. That operation produced about 266.8 million SUPRA.
Around three hours later, the attacker repeated the method through five wallets. The second wave generated another 26.9 million SUPRA. Together, both waves created 809,051.55 CASH in new debt and extracted 293,705,544.97 SUPRA.
The report classified the incident as a pricing-path defect combined with weak risk limits. It ruled out reentrancy and direct market manipulation as the cause. Solido also said its liquidation system continued operating during both waves, but front-end controls alone did not stop the later transactions from reaching the contracts on July 23.
On-chain tracing shows that roughly 246.9 million SUPRA, or 84% of the proceeds, reached centralized exchange infrastructure. About 220 million SUPRA moved to what investigators described as a ‘suspected Gate deposit address.’
Solido noted that blockchain activity alone cannot confirm who controls the address. Gate would need to verify whether it belongs to its platform and whether the funds remain available for restriction.
Another 26.9 million SUPRA reached an unidentified exchange-linked address. The remaining 46.8 million SUPRA stayed on-chain and had not moved when Solido prepared the forensic report.
Solido asked the exchanges to confirm the flagged accounts, preserve records, and restrict traced deposits where law allows. The team said it was not seeking broad account freezes or accusing any exchange of knowingly helping the attacker.
Solido said the attacker did not drain depositor balances or borrower positions. Instead, the attacker opened new positions and used overvalued collateral rather than removing assets from individual lending accounts.
Liquidity providers carried the loss after the attacker exchanged unsupported CASH for SUPRA in market pools. Attackers did not target Solido Flow, although the team paused the staking product as a safety measure.
Between 23:05 and 23:12 UTC, Solido disabled all six collateral listings and closed the minting route used during the attack. The protocol remains paused while the team tracks funds and prepares recovery steps.
Meanwhile, DeFiLlama lists Solido’s combined total value locked at about $664,000. SUPRA traded near $0.00025 on July 28 and had lost about 94% over the previous year. The exploit added further selling pressure while the foundation faced a large reserve shortfall.
