Robinhood Chain Loses $56,000 in CASHCAT Hack Nine Days After Launch

Robinhood’s new blockchain is already bleeding users dry. The mainnet went live July 1, and within days, traders were posting loss after loss on social media — scam tokens, phishing links, wallet drainers, the whole mess.

Relay Protocol moved fast, issuing warnings about fraudulent tokens circulating on Robinhood Chain. The core mechanism is pretty nasty: a scam contract credits a user’s wallet momentarily, then reroutes the tokens straight back to the deployer’s wallet. So the buyer pays real money, sees a flash of tokens, and ends up with nothing. Relay was blunt about it — funds spent on these tokens are gone. Not recoverable. Not disputable through any on-chain mechanism. Just gone.

One trader said Robinhood Wallet’s default settings auto-filled a scam coin called USER during a transaction. Without manually changing those defaults, funds vanished almost immediately. Another user tried swapping ETH for a memecoin named $ROBINHOOD, only to watch the tokens get rerouted to a wallet they didn’t control.

$56,000 Gone in a Single Contract Exploit

The biggest single hit researchers flagged involved a hacked smart contract tied to a memecoin called CASHCAT. One holder lost $56,000. That’s not a rounding error — that’s a serious sum, wiped out through a vulnerability that bad actors apparently spotted and exploited before anyone could respond. Researchers pointed directly at the contract as the culprit, and it’s probably the clearest sign yet that Robinhood Chain’s permissionless architecture is being weaponized faster than the platform can handle.

There’s also HOODIE, an AI-branded Robinhood Chain memecoin that halved in value in a single afternoon. And ROGE, which researchers identified as a honeypot — a contract with a backdoor baked in, letting malicious actors drain buyers while the token appeared to function normally. Honeypots are a well-known scam format in crypto, but they tend to cluster on new chains where users are excited and maybe not reading contract code as carefully as they should.

A user lost $350 when a Robinhood Chain asset swap on OpenSea redirected coins to an unauthorized address. Another trader lost $50 and tagged CEO Vlad Tenev directly in the complaint on social media. Whether Tenev or anyone at Robinhood saw it and chose not to respond, or whether it just got lost in the noise — unclear. No official statement from the company had come out as of nine days post-launch.

Related: Crypto Trader Loses $1 Million After Approving a Single Bad Token

Memecoins Dominate Early Trading

Here’s the part that makes the broader picture worse: memecoins make up over 75% of recent trading activity on Robinhood Chain. That’s not a healthy ratio for a brand-new blockchain trying to build credibility. Memecoins are speculative by design, prone to rapid price collapses, and easy to weaponize. When they dominate a nascent platform’s volume, it basically signals open season for scammers who know the user base is chasing fast gains and maybe skipping the due diligence.

Some researchers and traders have started calling the situation a “rug mania.” That’s a loaded phrase in crypto circles — it basically means the environment has become so saturated with exit scams and honeypots that legitimate activity gets drowned out. It’s not a formal designation, just a vibe that’s spreading through the community as loss reports pile up.

The calls for fixes are getting louder. Traders are pushing for the revoke-approvals feature to be enabled — a tool that lets users undo smart contract authorizations after the fact. It’s a standard security option on many chains, and the fact that it’s not prominently available on Robinhood Chain is a real gap. Others are just telling people to audit contracts before touching them, which is good advice but probably unrealistic for retail users who downloaded a wallet app expecting something safer than a DeFi frontier.

Permissionless blockchains carry this risk by design. Anyone can deploy a contract, which is the whole point — but it also means anyone can deploy a malicious one. Established chains have years of community tooling, scam databases, and token screening layers built up around them. Robinhood Chain has nine days.

Related: Injective npm Package Hit by Backdoor Attack Targeting Crypto Wallet Keys

And so far, Robinhood hasn’t said anything publicly about what happened to the users who lost money, whether any remediation is planned, or how the platform intends to handle the scam environment going forward. No comment. Nothing on the record.

The CASHCAT holder is still out $56,000.