Optim Finance, a Cardano-native decentralized finance (DeFi) protocol, said on Sunday that a Splash pool supporting OADA had been exploited and that the OADA and Cardano’s native token ADA held inside the pool were now controlled by an attacker.
The team said the immediate damage appeared contained to those pool balances, but the same actor then moved to empty every other venue where OADA had been paired against various tokens, effectively wiping out the ADA-pegged synthetics’ on-chain market.
In an X post published at 06:57 UTC on September 13, the protocol advised anyone providing liquidity for OADA or its governance token O to withdraw immediately. It added that the protocol is paused, remaining liquidity has been pulled, and there is currently no OADA liquidity anywhere. A follow-up statement with more detail was promised.
Splash Protocol, the Cardano decentralized exchange (DEX) that hosts the OADA/ADA stableswap, had not issued a matching public statement at the time of writing. DefiLlama data showed Splash Protocol total value locked (TVL) near $3.3 million on Cardano, with a one-day decline of roughly 27 percent in one snapshot, though that figure has not been independently tied to the incident. Cardano DeFi as a whole was tracking around $55 million in TVL.
Why the Splash Pool Sits at the Centre of OADA
OADA is Optim Finance’s ADA-pegged synthetic asset. Users mint it 1:1 against ADA, and it does not accrue staking yield directly; that yield is routed to sOADA, the staked counterpart that also absorbs any system losses.
Crucially, OADA has no direct redemption path back to ADA. The only documented exit is a swap through the OADA/ADA stableswap on Splash, as spelled out in Optim Finance’s own documentation.
That same documentation states that an Algorithmic Market Operation (AMO) on the Splash pool is what keeps OADA inside a 0.99 to 1.01 band against ADA. When OADA trades rich, the system mints and sells OADA into the pool. When it trades cheap, the system deploys ADA reserves to buy OADA back. Because the pool is both the peg-defending tool and the sole exit ramp, a drain there simultaneously freezes conversion and removes the mechanism designed to defend the peg.
The pool once ranked among Cardano’s largest stableswaps. Splash publicly marked the ADA-OADA pool at 9 million ADA in TVL in July 2024, which is why a pool-level incident now carries ecosystem weight even if the dollar loss remains unconfirmed.
ADA was trading in the $0.20 to $0.21 range on September 13, according to public market data. Currently, according to CoinGecko data, Cardano (ADA) is trading at $0.2047, down by 1.8% in 24 hours, with a market cap of $ 7.686 billion as of September 13, 2026, at 10:43 AM UTC. Without an official quantity from Optim Finance, any dollar estimate of the drained pool would be speculative.
What Is Known So Far
Confirmed publicly by Optim Finance:
- A Splash pool that supported OADA was exploited.
- The pool’s OADA and ADA are now with the attacker.
- Other OADA trading venues were emptied of liquidity by the same actor.
- The protocol is paused, and OADA liquidity has been fully removed.
- Users should not supply OADA or O liquidity anywhere.
Not yet disclosed:
- The exact ADA and OADA amounts taken.
- The transaction hashes and attacker addresses.
- Whether the vulnerability originated inside Splash pool logic, an Optim AMO, or the integration between the two.
- Whether sOADA holders will absorb any residual loss. Optim’s documentation assigns unforeseen system losses to sOADA while describing AMO risk as parameterized and limited, but that loss allocation has not been restated since the exploit.
The Cardano base layer itself was not implicated. As framed by Optim Finance, the incident is confined to application-layer liquidity around OADA rather than the underlying blockchain.
Context: A Heavy Stretch of DeFi Incidents
September 2026 has already produced a cluster of publicly reported exploits across DeFi. The Liquid Network peg-out event earlier this month drained roughly $320 million in Bitcoin from Blockstream’s sidechain federation wallet, before most of the funds were returned. Blockchain security firm SlowMist later attributed that flaw to a cache-collision bug that allowed 3,998 unbacked L-BTC to be minted.
Smaller reserve and vault drains have also stacked up. Zentra Finance reported a roughly $143,000 exploit on its ctUSD reserve on Citrea earlier this week. ether.fi lost 15.45 ETH in a legacy AtomicQueue exploit, with its chief executive pledging full user reimbursement. A separate attacker targeting the Symbiosis Bridge reportedly minted about 368.9 billion synthetic Bitcoin (syBTC), some of which were converted to wrapped Bitcoin on Uniswap V4.
The Optim Finance disclosure is smaller in confirmed dollar terms than the Liquid Network headline, but it is materially significant inside Cardano DeFi, where a handful of pools still concentrate most of the ecosystem’s synthetic-ADA liquidity.
What Users and sOADA Holders Face Next
The immediate operational facts are the pause and the absence of any OADA-to-ADA market. Until Optim Finance or Splash publishes wallet addresses, drained amounts, and a technical account of the exploit, holders cannot independently verify recovery prospects or the residual exposure sitting inside sOADA.
Optim Finance has not published a technical cause. The team has only said a Splash pool supporting OADA was exploited and that other OADA pairs were then drained.
Optim Finance said more information would follow. Until that update lands, the only official instruction remains the one issued on Sunday morning: do not provide liquidity for OADA or O.
Also Read: Zcash Holder Says $589K USDT Stuck on NEAR Intents 50 Days After Zodl Swap
