Splash fixes exploit as 2.4M ADA remains missing

• Splash has patched the validator exploit, closing the documented attack path that drained its Cardano (CRYPTO:ADA)-based ADA/OADA pool.
• The pool lost 2,424,778 ADA, leaving only 10 ADA and about 1.44 million OADA immediately after the drain.
• OADA holders still lack a clear exit route, with restored ADA liquidity or protocol-level redemption needed before a full relaunch.

Splash has patched the validator exploit after an attacker drained its Cardano (CRYPTO:ADA)-based ADA/OADA StableSwap pool on September 13.

Splash’s incident report said one actor removed 2,434,648 ADA and 1,988,222 OADA through two transactions.

After subtracting the attacker’s 9,870 ADA deposit, the net ADA loss reached 2,424,778 before network fees, according to Splash.

The exploit involved a validator that allowed its tradable ADA reserve to become negative without enforcing the required swap direction.

A reserve-domain check or two-sided fee limit would have prevented the documented attack, but neither measure can recover the ADA already removed.

The pool held just 10 ADA and about 1.44 million OADA after the drain, while other OADA markets also had limited ADA liquidity.

Splash has said OADA had no protocol-level redemption route, while Optim Finance has paused its protocol and continued working on an accounting of affected addresses and assets.

At the time of reporting, Cardano price was $0.2146.