Cardano Pool Drained of $2.4M in ADA: Holders Left Trapped

The Cardano-based ADA/OADA StableSwap pool on the Splash platform was drained of 2.4 million ADA, leaving OADA holders trapped and without a meaningful exit strategy.

According to an incident report by Splash, one attacker used two transactions on September 13 to remove 2,434,648 ADA and 1,988,222 OADA from the pool.

The attack exploited a vulnerability in the validator's code, which did not require the tradable ADA reserve to remain positive. The validator accepted a transaction after the reserve turned negative, allowing the attacker to drain the funds.

A code patch has since been implemented to stop the documented exploit path, but it does not restore the lost ADA or provide an exit strategy for OADA holders.

The situation is further complicated by the fact that OADA has no protocol-level redemption and other venues holding OADA are close to empty.