Solido Money Traces 293M Stolen SUPRA Tokens to Cryptocurrency Exchanges

Key Highlights

• Solido Money released a comprehensive forensic analysis detailing the theft of roughly 293.7 million SUPRA tokens from its protocol
• Attackers conducted two distinct exploit operations, both leveraging an oracle configuration error that drastically inflated collateral valuations
• Forensic tracking identified that approximately 84% of stolen assets, totaling 246.9 million SUPRA, moved to centralized exchange wallets
• Investigators traced roughly 220 million SUPRA to what appears to be a Gate.io deposit wallet
• The protocol is requesting that exchanges implement holds on identified funds and maintain records for law enforcement cooperation

Following a major security breach on July 23, 2026, Solido Money has published an extensive forensic analysis that maps the movement of stolen cryptocurrency and appeals to centralized exchanges for asset recovery assistance.

ALERT: Solido reports an exploit drained 293.7M $SUPRA worth $900K.

Around 220M $SUPRA has reportedly been routed to a suspected Gate deposit address, with nearly 90% of the stolen funds believed to have belonged to the Supra Foundation.

The chain now holds just $950K in TVL… pic.twitter.com/147zAlvGeM

— Coin Bureau (@coinbureau) July 28, 2026

According to the protocol’s investigation, attackers conducted two distinct exploit operations that together yielded 293.7 million SUPRA tokens. Each operation capitalized on an identical security weakness — a misconfigured oracle system that dramatically inflated the perceived value of deposited collateral.

This configuration error caused the protocol to calculate collateral values at nearly one dollar per unit, despite the actual trading price representing only a small fraction of that amount. Exploiting this discrepancy, the attacker deposited overvalued collateral to generate CASH tokens, which were subsequently converted into SUPRA.

The initial exploit occurred through a single atomic blockchain transaction. Hours afterward, the attacker launched a second operation using the identical technique, this time distributing the activity across five different wallets through manual execution.

Combined, both operations generated 809,052 CASH tokens and extracted 293.7 million SUPRA in total proceeds. Blockchain security company PeckShield verified the incident and indicated that approximately 90% of the compromised assets belonged to the Solido foundation itself.

Tracking the Stolen Assets

Through blockchain forensics, Solido determined that roughly 246.9 million SUPRA tokens — representing 84% of the stolen total — were transferred to infrastructure associated with centralized cryptocurrency exchanges.

The remaining 46.8 million SUPRA remained in on-chain wallets when the forensic report was released.

Regarding the initial exploit wave, investigators traced 220 million SUPRA to a wallet address they believe functions as a Gate.io deposit endpoint. Solido acknowledged that blockchain evidence alone cannot definitively establish this connection and requires exchange confirmation.

A second exchange destination was identified in connection with the subsequent exploit wave. These funds were deposited into what Solido characterized as user-specific exchange infrastructure before being consolidated into a larger omnibus custody wallet.

Solido’s Request to Exchanges

The protocol is now requesting that cryptocurrency exchanges verify whether the identified wallet addresses operate under their control. Additionally, Solido is asking platforms to place restrictions on any traced deposits and maintain all associated account information for potential law enforcement investigations.

The organization emphasized that it is not requesting broad account freezes affecting unrelated customers and is not suggesting that any exchange deliberately facilitated the theft.

Following the attack, Solido implemented smart contract modifications that permanently disable the minting functionality exploited in the breach. The report observed that merely taking the user interface offline proved insufficient to prevent the second attack wave.

Solido clarified that its investigative conclusions rely exclusively on blockchain transaction data and do not identify any specific individuals.

The post Solido Money Traces 293M Stolen SUPRA Tokens to Cryptocurrency Exchanges appeared first on Blockonomi.