A DeFi Protocol Got Tricked by Its Own Price Feed — Here’s Where the Money Went
Solido Money says hackers used a broken oracle to fake collateral values and drain 293.7M SUPRA tokens — most of it has now been traced to exchanges.
If you’ve ever wondered how a hacker can drain a crypto protocol without breaking a single line of “real” code, the Solido Money incident is a textbook example. The DeFi platform says attackers exploited a faulty price feed — not a stolen key or a leaked password — to trick its system into thinking worthless collateral was worth almost a dollar a token. The result: 293.7 million SUPRA tokens, worth roughly $900,000, walked out the door.
Solido Money published a detailed forensic report following the breach, which happened on July 23, 2026. The team says it has now traced most of the stolen funds to wallets linked to centralized exchanges, and it’s asking those platforms to help freeze what’s left before it disappears for good.
What actually went wrong
For everyday holders unfamiliar with DeFi plumbing, an “oracle” is the piece of software that tells a protocol what an asset is currently worth on the open market. Solido’s oracle was misconfigured, so it valued deposited collateral at nearly $1 per unit — even though the real market price was a small fraction of that.
Attackers exploited that gap by depositing the overvalued collateral, minting CASH tokens against it, and then converting those CASH tokens into SUPRA. The first attack was a single, tightly executed blockchain transaction. A second wave followed just hours later, this time spread manually across five separate wallets. Together, the two operations produced 809,052 CASH tokens and 293.7 million SUPRA in stolen proceeds.
Security firm PeckShield reviewed the incident and estimated that around 90% of the stolen funds actually belonged to the Solido Foundation itself rather than individual users — which, while still a serious loss, limits the direct damage to everyday token holders compared to a hack that drains user deposits.
Following the money to exchanges
Blockchain tracing showed that about 246.9 million SUPRA — 84% of everything stolen — moved into wallets connected to centralized exchanges. Roughly 46.8 million SUPRA is still sitting in on-chain wallets, not yet cashed out.
Investigators say around 220 million SUPRA from the first exploit ended up in what looks like a Gate.io deposit address, though Solido is careful to note that on-chain data alone can’t prove that with certainty — it needs the exchange to confirm it. Funds from the second wave reportedly went through smaller, user-linked exchange wallets before being pooled into a larger custody wallet.
Solido isn’t accusing any exchange of wrongdoing. It’s simply asking platforms to check whether the flagged addresses belong to them, place holds on the funds, and keep records in case law enforcement gets involved. Importantly, the protocol says it isn’t asking for a blanket freeze on unrelated customer accounts.
Why this matters if you hold DeFi tokens
This isn’t a wallet-draining phishing scam or an exchange collapse — it’s a reminder that even well-built DeFi protocols depend on accurate outside price data to function safely. When that single link breaks, attackers can manufacture “value” out of thin air, and it usually only takes minutes once found.
Solido says it has since permanently disabled the minting function that made the exploit possible, after learning the hard way that simply taking its website offline didn’t stop attackers from striking a second time on-chain. For anyone holding SUPRA or using similar lending-style protocols, it’s a useful nudge to check whether a project’s price oracles are independently audited — and to remember that a project’s total value locked can shrink dramatically overnight when trust in its pricing mechanism breaks.
Read more: Whales Just Pulled $198M in Bitcoin Off Kraken — Here’s What It Means for Your BTC
