Solido Money has reported a major DeFi exploit in which attackers drained 293.7 million SUPRA tokens by exploiting a pricing error in its Solido Cash protocol. The stolen tokens were valued at approximately $900,000 at the time of the attack on July 23, 2026. According to blockchain security firm PeckShield, about 90% of the affected funds belonged to the Solido Foundation, exacerbating the project’s financial strain as its total value locked fell below $1 million and SUPRA traded near historic lows.
Oracle Error Enabled Two Exploit Waves
Solido’s forensic review traced the breach to an oracle misassignment involving SOLID, a token used as backstop collateral. A stale price feed triggered fallback logic that valued SOLID far above its actual market price. The attacker used the inflated collateral value to mint CASH without sufficient backing, then exchanged the newly created CASH for SUPRA, removing tokens from trading pools.
The first wave began at 18:21 UTC and used a single transaction to swap tokens, deposit collateral, mint CASH, and sell it, producing approximately 266.8 million SUPRA. About three hours later, the attacker repeated the method through five wallets, generating another 26.9 million SUPRA. Together, both waves created 809,051.55 CASH in new debt and extracted 293,705,544.97 SUPRA. The incident was classified as a pricing-path defect combined with weak risk limits, ruling out reentrancy or direct market manipulation. Solido noted that its liquidation system operated during both waves, but front-end controls alone did not stop the later transactions from reaching the contracts on July 23.
Most Stolen SUPRA Reached Exchanges
On-chain tracing revealed that roughly 246.9 million SUPRA, or 84% of the proceeds, reached centralized exchange infrastructure. About 220 million SUPRA moved to a suspected Gate deposit address. Solido stated that blockchain activity alone cannot confirm who controls that address; Gate would need to verify whether it belongs to its platform and whether the funds remain available for restriction. Another 26.9 million SUPRA reached an unidentified exchange-linked address, while the remaining 46.8 million SUPRA stayed on-chain and had not moved when the forensic report was prepared.
Solido has asked the exchanges to confirm flagged accounts, preserve records, and restrict traced deposits where law allows. The team clarified it is not seeking broad account freezes or accusing any exchange of knowingly assisting the attacker.
Foundation Loss Deepens Market Pressure
Solido emphasized that the attacker did not drain depositor balances or borrower positions. Instead, the attacker opened new positions using overvalued collateral rather than removing assets from individual lending accounts. Liquidity providers bore the loss after the attacker exchanged unsupported CASH for SUPRA in market pools. Solido Flow was not targeted, but the team paused the staking product as a safety measure.
Between 23:05 and 23:12 UTC on July 23, Solido disabled all six collateral listings and closed the minting route used during the attack. The protocol remains paused while the team tracks funds and prepares recovery steps. DeFiLlama lists Solido’s combined total value locked at about $664,000. SUPRA traded near $0.00025 on July 28 and had lost about 94% over the previous year. The exploit added further selling pressure while the foundation faced a large reserve shortfall.