Splash / Optim Finance (OADA) Cardano StableSwap Exploit
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·7ARMZk…jbjJSummary
On September 13, 2026, an attacker exploited a validator flaw in Splash Protocol's ADA/OADA StableSwap pool on Cardano, draining approximately 2,434,648 ADA and 1,988,222 OADA in two transactions. Splash subsequently patched the underlying vulnerability, but roughly 2.42 million ADA remains unrecovered and OADA holders are unable to redeem their positions as of mid-September 2026, with Optim Finance still auditing impacted addresses and no confirmed remediation path announced.
Connected Entities
1 entityNo connected entities recorded yet — this investigation is not currently linked to any other page in the index.
Community submissions
- Under reviewincriminatingWayback pending9/19/2026, 10:14:07 PM
“Confirms the exploit path was patched but ~2.4M ADA remains missing and OADA holders remain unable to redeem — the loss is unresolved, not recovered.”
— avoid-scout
Timeline(5 events)
13 September 2026
Attacker executes two transactions against Splash Protocol's ADA/OADA StableSwap pool on Cardano, draining 2,434,648 ADA and 1,988,222 OADA by exploiting a validator flaw that permitted negative tradable reserves and did not enforce swap direction.
CryptoTimes13 September 2026
Optim Finance announces at approximately 06:57 UTC via X that its protocol is paused, all OADA liquidity has been removed across Cardano DeFi, and OADA-to-ADA swaps are unavailable. Users are advised to withdraw immediately.
CryptoTimes13 September 2026
Following the exploit, the Splash ADA/OADA pool holds only 10 ADA and approximately 1.44 million OADA. Splash's TVL declines approximately 27% to around $3.3 million. Cardano DeFi TVL at approximately $55 million overall.
CryptoTimes / CryptoSlate15 September 2026
Optim Finance publishes an update stating it is indexing the chain and compiling a full accounting of impacted addresses and assets. No liquidity restoration, redemption mechanism, or compensation plan is announced.
CryptoSlate15 September 2026
Splash releases a validator patch closing the documented exploit path, addressing the missing reserve non-negativity check, the unidirectional fee bound, and the absent swap-direction enforcement. Approximately 2,424,778 ADA remains unrecovered.
CryptoSlate / KuCoin NewsDecision Log
- hash: BUY7XzJH5U8Ymk4gmksYC43ULS9F2qmQvFfN7FfgSfqD
This investigation is cryptographically anchored to the Solana blockchain (1 event). 8 of 9 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 9/19/2026, 12:05:17 PM
last updated: 9/19/2026, 5:12:56 PM
avoid.net — verified advice for a post-truth world