Cardano's Splash DEX exploited, draining over 2.4M ADA and 1.98M OADA.

Key points

• Splash DEX experienced a security breach on September 13, 2026, where an attacker drained 2,434,648.42 ADA and 1,988,222.18 OADA from the ADA/OADA StableSwap pool.
• Following the exploit, Optim Finance, a Cardano-native DeFi protocol, paused the OADA protocol and urged users to withdraw their funds, citing the drained liquidity from the Splash pool.
• Splash DEX acknowledged the exploit, attributed it to a vulnerability in the pool’s validator, and is investigating the incident while advising users against adding new liquidity to the affected pool.
• The exploit has led to a decline in Cardano's DeFi activity, with total value locked (TVL) dropping below 300 million ADA and active addresses at 12,204, indicating reduced investor confidence.