Cardano-based decentralized exchange (DEX) Splash has suffered a security exploit that drained millions of ADA and OADA from its ADA/OADA StableSwap pool.
Both Splash and Cardano-based DeFi yield optimization platform Optim Finance confirmed that the exploit was isolated to the Splash pool supporting ADA and OADA.
Splash’s ADA/OADA Pool Drained
According to Splash, the incident occurred on September 13, 2026, between 00:47 and 00:48 UTC. During the attack, the exploiter drained the affected pool through two transactions.
The second transaction removed 2,434,648.42 (2.43 million) ADA and 1,988,222.18 (1.98 million) OADA from the pool. After accounting for the attacker’s 9,870 ADA deposit, the net ADA drain amounted to 2,424,778.42 ADA.
Splash attributed the exploit to a vulnerability in the pool’s validator. Specifically, the validator calculated the tradable reserve by subtracting accrued protocol fees from the pool’s actual balances but failed to verify that the resulting reserve remained positive.
Per the update, the attacker manipulated the fee counter and then spent the pool’s actual ADA balance below that counter. Consequently, the validator accepted a negative reserve and allowed the attacker to withdraw both assets.
The exploit also affected liquidity venues pairing OADA with various tokens. However, Optim Finance said the collateral damage appeared limited to those pools. Splash likewise confirmed that other pool types were not affected.
Following the incident, Splash paused the protocol and removed liquidity from the affected venues. Consequently, the DEX currently has no meaningful OADA liquidity, preventing users from swapping OADA for ADA through the exploited pool.
Movement of Stolen Funds
After draining the pool, the attacker moved the stolen OADA into a thin OADA/FLDT pool on Minswap and converted part of the holdings into ADA.
Splash said the attacker received only about 115,000 ADA from the sale because of the pool’s limited liquidity. Meanwhile, 1.76 million OADA remained in the Minswap pool at the time of the report, trading at only a small fraction of its intended peg.
Splash therefore warned users against adding fresh ADA/OADA liquidity, as doing so could expose them to arbitrage involving the remaining OADA.
The attacker also distributed the stolen ADA across six deposit addresses before consolidating the funds into four custodial clusters.
Splash attributed 786,851 ADA to KuCoin and another 550,000 ADA to Gate.io. The remaining 1.21 million ADA was held in custodial systems whose operators had not yet been identified.
Splash is now investigating the exchange-linked funds and said it will contact KuCoin and Gate.io while continuing to trace the attacker’s wallets.
In the meantime, the DEX has invited the attacker to contact its team to resolve the incident through a bug bounty or white-hat recovery arrangement.
Splash Exploit Adds to Cardano DeFi Security Concerns
The Splash exploit comes amid several recent security incidents involving projects across the Cardano ecosystem.
Last week, Dano Finance suffered an exploit involving its lending pools across 26 transactions. Attackers reportedly drained 523,546 USDA, 457,808 USDM, 737,708 USDCx, 7,131,442 NIGHT and 0.728 BTC.
Separately, Cardano-based DeFi platform Empowa disclosed unauthorized transfers involving approximately 143,710 ADA and 48,219 NIGHT from project-controlled treasury wallets. In June, SecondFi also reported that hackers stole more than 16 million ADA from 374 user wallets.
Therefore, the latest Splash exploit adds another significant security incident to a growing list of exploits and unauthorized transfers affecting Cardano’s decentralized finance sector.