Request

SUPRA

2026

Cryptocurrency

Coin

<h3 id="key-highlights">Key Highlights</h3>
<ul>
 <li>Solido Money released a comprehensive forensic analysis detailing the theft of roughly 293.7 million SUPRA tokens from its protocol</li>
 <li>Attackers conducted two distinct exploit operations, both leveraging an oracle configuration error that drastically inflated collateral valuations</li>
 <li>Forensic tracking identified that approximately 84% of stolen assets, totaling 246.9 million SUPRA, moved to centralized exchange wallets</li>
 <li>Investigators traced roughly 220 million SUPRA to what appears to be a Gate.io deposit wallet</li>
 <li>The protocol is requesting that exchanges implement holds on identified funds and maintain records for law enforcement cooperation</li>
</ul>
Following a major security breach on July 23, 2026, Solido Money has published an extensive forensic analysis that maps the movement of stolen cryptocurrency and appeals to centralized exchanges for asset recovery assistance.
<blockquote class="twitter-tweet">
 <img src="https://s.w.org/images/core/emoji/17.0.2/72x72/26a0.png" alt="⚠" style="height: 1em; max-height: 1em;">ALERT: Solido reports an exploit drained 293.7M <a href="https://x.com/search?q=%24SUPRA&amp;src=ctag&amp;ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">$SUPRA</a> worth $900K.
 Around 220M <a href="https://x.com/search?q=%24SUPRA&amp;src=ctag&amp;ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">$SUPRA</a> has reportedly been routed to a suspected Gate deposit address, with nearly 90% of the stolen funds believed to have belonged to the Supra Foundation.
 The chain now holds just $950K in TVL… <a href="https://t.co/147zAlvGeM" rel="noopener noreferrer nofollow">pic.twitter.com/147zAlvGeM</a>
 — Coin Bureau (@coinbureau) <a href="https://x.com/coinbureau/status/2081974863192072249?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">July 28, 2026</a>
</blockquote>
According to the protocol’s investigation, attackers conducted two distinct exploit operations that together yielded 293.7 million SUPRA tokens. Each operation capitalized on an identical security weakness — a misconfigured oracle system that dramatically inflated the perceived value of deposited collateral.
This configuration error caused the protocol to calculate collateral values at nearly one dollar per unit, despite the actual trading price representing only a small fraction of that amount. Exploiting this discrepancy, the attacker deposited overvalued collateral to generate CASH tokens, which were subsequently converted into SUPRA.
The initial exploit occurred through a single atomic blockchain transaction. Hours afterward, the attacker launched a second operation using the identical technique, this time distributing the activity across five different <a href="https://coincentral.com/kraken-parent-payward-buys-magic-labs-wallet-business-powering-60-million-users/" rel="noopener noreferrer nofollow">wallets</a> through manual execution.
Combined, both operations generated 809,052 CASH tokens and extracted 293.7 million SUPRA in total proceeds. Blockchain security company PeckShield verified the incident and indicated that approximately 90% of the compromised assets belonged to the Solido foundation itself.
<h3 id="tracking-the-stolen-assets">Tracking the Stolen Assets</h3>
Through blockchain forensics, Solido determined that roughly 246.9 million SUPRA tokens — representing 84% of the stolen total — were transferred to infrastructure associated with centralized cryptocurrency exchanges.
The remaining 46.8 million SUPRA remained in on-chain wallets when the forensic report was released.
Regarding the initial exploit wave, investigators traced 220 million SUPRA to a wallet address they believe functions as a Gate.io deposit endpoint. Solido acknowledged that blockchain evidence alone cannot definitively establish this connection and requires exchange confirmation.
A second exchange destination was identified in connection with the subsequent <a href="https://coincentral.com/triple-a-hot-wallets-lose-9-7m-in-suspected-multi-chain-exploit/" rel="noopener noreferrer nofollow">exploit</a> wave. These funds were deposited into what Solido characterized as user-specific exchange infrastructure before being consolidated into a larger omnibus custody wallet.
<h3 id="solido-s-request-to-exchanges">Solido’s Request to Exchanges</h3>
The protocol is now requesting that cryptocurrency exchanges verify whether the identified wallet addresses operate under their control. Additionally, Solido is asking platforms to place restrictions on any traced deposits and maintain all associated account information for potential law enforcement investigations.
The organization emphasized that it is not requesting broad account freezes affecting unrelated customers and is not suggesting that any exchange deliberately facilitated the theft.
Following the attack, Solido implemented smart contract modifications that permanently disable the minting functionality exploited in the breach. The report observed that merely taking the user interface offline proved insufficient to prevent the second attack wave.
Solido clarified that its investigative conclusions rely exclusively on blockchain transaction data and do not identify any specific individuals.
The post <a href="https://blockonomi.com/solido-money-traces-293m-stolen-supra-tokens-to-cryptocurrency-exchanges/" rel="noopener noreferrer nofollow">Solido Money Traces 293M Stolen SUPRA Tokens to Cryptocurrency Exchanges</a> appeared first on <a href="https://blockonomi.com" rel="noopener noreferrer nofollow">Blockonomi</a>.

Solido Money Traces 293M Stolen SUPRA Tokens to Cryptocurrency Exchanges

Table of Contents

Blockonomi

Other articles published on Jul 28, 2026

Join our free newsletter for daily crypto updates!