Cardano's Splash DEX exploit drains 2.4M ADA; OADA holders face liquidity issues

Key points

• Splash DEX Exploit: On September 13, 2026, an attacker drained 2,434,648 ADA and 1,988,222 OADA from Splash's ADA/OADA StableSwap pool.
• Validator Vulnerability: The exploit was attributed to a vulnerability in the pool's validator, which allowed the attacker to withdraw both assets by manipulating the fee counter.
• Liquidity Challenges for OADA Holders: Following the exploit, OADA holders are facing difficulties accessing their funds due to the drained pool and lack of a redemption mechanism.
• Security Upgrade Released: In response to the exploit, the Hydra 2.4.1 security upgrade was released to patch a critical fund-stealing vulnerability.