- One actor removed 2,434,648 ADA and 1,988,222 OADA from Splash’s ADA/OADA pool in two transactions on 13 September, according to Splash’s own incident report. Net of a 9,870 ADA deposit, and before fees, the ADA drain was 2,424,778.
- Splash has identified the missing checks in its code and says either of two fixes would have blocked the attack. Neither returns the ADA.
- Optim Finance paused its on 13 September and has not announced restored liquidity, a redemption route, or any compensation.
A pegged is only worth what you can swap it for. About 2.4 million ADA left the pool that made those swaps possible on 13 September, and three days later the people holding OADA still had no way out.
A patched contract and a repaid holder are two different things, and only one of them has happened. Anyone still holding OADA is waiting on a decision Optim Finance has not made publicly: whether the missing ADA gets replaced, partly replaced, or absorbed by the people who deposited. There is no deposit protection sitting behind any of this, which makes that decision the entire story for those affected.
What the pool was actually for
OADA is a token designed to track the price of ADA one for one. A token like that holds its peg because there is somewhere you can reliably trade it back at close to that rate, and on Cardano the main place was a StableSwap pool run by Splash.
A StableSwap pool is a pot holding two assets that are supposed to be worth roughly the same, in this case ADA and OADA. Anyone can swap one for the other against the pot, and the maths is tuned to keep the exchange rate near parity as long as both sides hold reasonable balances. The ADA in that pot was not a nice extra. It was the thing OADA holders would draw on to get back to ADA.
Immediately after the drain, Splash’s report puts the pool at roughly 10 ADA against about 1.44 million OADA. The exit had been emptied.
What the report says went wrong
Splash’s validator, the code that decides whether a swap is allowed, worked out a “tradable” reserve by subtracting accrued protocol fees from the pool’s real balances. That word is Splash’s own, taken from its incident report, and the report is the project’s account of what happened to the project’s own code.
Three checks were missing. The tradable reserve was not required to stay above zero, changes to the fee figure were bounded only from below, and the direction of a swap was not enforced. Put together, those gaps let the validator accept a transaction after the tradable ADA reserve had already gone negative.
Splash says a reserve-domain check, or bounding the fee from both sides, would have stopped the attack when it reconstructed it. The report is unusually specific about the code and unusually quiet about the money, and it is the second half that OADA holders are waiting on.
The fix does not refill the pool
Both proposed fixes close the documented path. Neither one brings back ADA that has already left, a point Splash is reported as making itself.
That leaves the practical position unchanged. OADA has no protocol-level redemption mechanism, according to the snapshot in the report, so there is no button that converts the token back to ADA independently of a market. Other venues trading OADA held single or double digit ADA balances at the time, with one exception: a Minswap V2 pool holding 1,763,923 OADA against 45,751 FLDT at 14:53 UTC on 13 September, which is a route into a different token rather than a route back to ADA.
Optim Finance said on 13 September that its protocol was paused, remaining liquidity had been removed, and OADA-to-ADA swaps were unavailable. Its 15 September update said it was indexing the chain and compiling a full accounting of impacted addresses and assets while working towards a resolution. That is process language. It does not commit to a remedy, a timeline, or the return of funds, and no relaunch or reopening had happened at the time of reporting.
What has not been established
The attribution to a single actor using two transactions is Splash’s own reconstruction from on-chain data. We found no independent forensic confirmation of it.
Nor is there a confirmed dollar figure. Neither Splash nor Optim states one in the material reviewed, so any USD number attached to this story elsewhere is an estimate derived from ADA’s market price rather than a reported loss. Our figures come from CryptoSlate’s direct quotation and paraphrase of the incident report PDF.
If you held OADA
Check which addresses of yours interacted with the pool or held OADA and sOADA, and save the transaction hashes now, because the accounting Optim says it is compiling will be easier to contest with a record in hand. UK readers should know that positions sit outside the FCA’s protections and the FSCS, so there is no compensation scheme to fall back on. Losses to theft can be reported to Action Fraud, and if you are working out what a disposal or a loss means for your tax position, our crypto tax guide covers how HMRC treats it. There is more of our DeFi coverage in the DeFi section.
What to watch
The accounting Optim said it was compiling. Whether it names a number of affected addresses and a proposed remedy, or simply confirms the scale of the hole, is the difference between a resolution and an acknowledgement.
After that, whether anyone commits to making holders whole, in full or in part, and who pays. Reopening the pool with corrected code is the easy half and could happen within days. The harder half has no announced date.