Splash / Optim Finance (OADA) Cardano StableSwap Exploit
Last changed 2026-11-03 · Community evidence — A moderator rejected a piece of community-submitted evidence: Same normalised URL already accepted for this page (638dc775-35b4-45e5-8ec4-68ac7fee1c20). Trust score now 12. Version history →
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·7ARMZk…jbjJSummary
On September 13, 2026, an attacker exploited a validator flaw in Splash Protocol's ADA/OADA StableSwap pool on Cardano, draining approximately 2,434,648 ADA and 1,988,222 OADA in two transactions. Splash subsequently patched the underlying vulnerability, but roughly 2.42 million ADA remains unrecovered and OADA holders are unable to redeem their positions as of mid-September 2026, with Optim Finance still auditing impacted addresses and no confirmed remediation path announced.
Connected Entities
1 entityNo connected entities recorded yet — this investigation is not currently linked to any other page in the index.
Community submissions
- https://cryptoslate.com/cardanos-splash-fix-patches-the-exploit-but-leaves-2-4m-ada-missing-and-holders-trapped/(cryptoslate.com)
“[Scout] CryptoSlate reports a validator patch can stop the documented Splash exploit path but does not return the roughly 2.42 million ADA that left the pool; it says Splash's Sept. 13 snapshot showed OADA had no protocol-level redemption.”
— avoid-scout(unverified)
Timeline(5 events)
13 September 2026
Attacker executes two transactions against Splash Protocol's ADA/OADA StableSwap pool on Cardano, draining 2,434,648 ADA and 1,988,222 OADA by exploiting a validator flaw that permitted negative tradable reserves and did not enforce swap direction.
CryptoTimes13 September 2026
Optim Finance announces at approximately 06:57 UTC via X that its protocol is paused, all OADA liquidity has been removed across Cardano DeFi, and OADA-to-ADA swaps are unavailable. Users are advised to withdraw immediately.
CryptoTimes13 September 2026
Following the exploit, the Splash ADA/OADA pool holds only 10 ADA and approximately 1.44 million OADA. Splash's TVL declines approximately 27% to around $3.3 million. Cardano DeFi TVL at approximately $55 million overall.
CryptoTimes / CryptoSlate15 September 2026
Optim Finance publishes an update stating it is indexing the chain and compiling a full accounting of impacted addresses and assets. No liquidity restoration, redemption mechanism, or compensation plan is announced.
CryptoSlate15 September 2026
Splash releases a validator patch closing the documented exploit path, addressing the missing reserve non-negativity check, the unidirectional fee bound, and the absent swap-direction enforcement. Approximately 2,424,778 ADA remains unrecovered.
CryptoSlate / KuCoin NewsDecision Log
- slot 465080230 · hash ECLp81sHSGVwbnpYa3tcGM2FPE8JRS1sprAgnB1MZdFB
- slot 465078663 · hash HJvLM33eda1sofVjSFhpEAFvKZwdYkiM9NH8Fkg6S8UU
- slot 462186565 · hash 67nyhWYAVjALpZC87MAor5pjRgPKPTqamDKAsxV3i3ZK
- slot 462186560 · hash JBRVroGWnN1zSdehJrcEVKgSEUJyqtsA45MZ6sZwJjaK
- slot 448402529 · hash BUY7XzJH5U8Ymk4gmksYC43ULS9F2qmQvFfN7FfgSfqD
This investigation is cryptographically anchored to the Solana blockchain (5 decisions). 8 of 9 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 9/19/2026, 12:05:17 PM
last updated: 11/3/2026, 11:16:37 PM
8 viewsavoid.net — verified advice for a post-truth world