Splash DEX ADA and OADA Stable Swap Pool Hacked, OADA Redemption Blocked

A Cardano-based decentralized exchange (DEX) called Splash experienced an incident where approximately 2.42 million ADA and about 1.99 million OADA were drained from its ADA/OADA stable swap pool. Following the incident, the primary pathway to convert OADA into ADA was blocked. Splash reported in a security bulletin that two transactions occurred between 09:47 and 09:48 KST on September 13, during which an attacker withdrew 2,434,648.42 ADA and 1,988,222.18 OADA, resulting in a net outflow of 2,424,778.42 ADA after excluding the initial 9,870 ADA deposited.

Splash stated that the incident occurred because the stable swap pool's verification mechanism failed to prevent transactions when the available reserves for covering protocol fees turned negative. The DEX added that other types of pools were unaffected by the issue. Nexus Mutual reported on September 15 that the attacker had partially converted the drained OADA into ADA using a thin liquidity pool in a minswap. Optim Finance has paused OADA and is recovering remaining liquidity, leaving OADA holders unable to redeem their holdings for ADA due to insufficient liquidity in the Splash pool.