The bug is fixed. The money isn't coming back, at least not yet.
🔓 What Happened
On September 13, a single attacker used just two transactions to drain Splash's ADA/OADA StableSwap pool on Cardano, taking 2,434,648 ADA and 1,988,222 OADA. After subtracting the attacker's own 9,870 ADA deposit, the net loss came to 2,424,778 ADA, which is roughly $475K at current prices. With ADA trading near $0.196, that figure is an estimate.
🐞 The Flaw
The pool's validator worked out a "tradable" reserve by subtracting protocol fees from real balances, but it never required that reserve to stay positive, only limited fee changes in one direction, and didn't enforce swap direction. Those gaps let it approve a swap even after the ADA reserve had gone negative.
🛠️ Patched, But Not Recovered
Splash says adding a reserve check or a two-sided fee limit closes the exploit path, but neither fix brings back the drained ADA. After the attack, the pool was left with only 10 ADA and about 1.44 million OADA.
🚨 The Real Problem for OADA Holders
OADA has no direct redemption back to ADA. The Splash pool was the only documented exit and also the tool that defended OADA's peg in a 0.99 to 1.01 range against ADA. With that pool drained, holders lost both their exit and their peg protection at the same time. Optim Finance paused its protocol and pulled the remaining liquidity. In a September 15 update, it said it was mapping every affected address and asset, but it announced no restored liquidity or redemption plan.
👀 What's Next
Until new ADA liquidity or a redemption path appears, OADA holders have no meaningful way out. This is a hard reminder that a patch fixes the code, not the losses.
Would you still trust Cardano DeFi after this? 👇
#Cardano #ADA #DeFi #CryptoNews #Hack
$ADA$ADA
