Splash (OADA/ADA stableswap) hack — September 2026

An attacker emptied the OADA/ADA stableswap on Splash, a Cardano exchange, at 14:53 UTC on 13 September 2026, taking 2,434,648 ADA and 1,988,222 OADA in two transactions. Net of the 9,870 ADA the attacker had deposited, and before network fees, 2,424,778 ADA left the pool, about $503,000 at the CoinGecko price for that day.

The 1,988,222 OADA is deliberately not valued here. OADA is an ADA-pegged synthetic issued by Optim Finance, and the same actor went on to empty every other venue where OADA was paired, so there was no market left to sell it into at par. Converting it at ADA parity would state a price the attacker could not have realised.

Splash's incident report says the pool validator computed a tradable reserve by subtracting accrued protocol fees from its real balances, never required that reserve to stay positive, bounded fee changes only from below, and did not enforce the direction of a swap, so swaps kept executing once the tradable ADA reserve had gone negative. Splash has patched it and says a reserve-domain check or a two-sided fee bound would have stopped the reconstructed attack. Neither brings back the ADA.

The pool was left holding 10 ADA and about 1.44m OADA. OADA has no protocol-level redemption and this stableswap was the documented way out of it, so holders are left without an exit. Optim Finance paused its protocol on 13 September, withdrew the remaining liquidity and stopped OADA-to-ADA swaps; on 15 September it said it was indexing the chain to compile a full accounting of affected addresses and assets, without restoring liquidity, redemption or operations.