Cascade hack steals $1.34 million from DeFi liquidity vault

The Cascade exploit put pressure on another promising DeFi project, with attackers stealing $1.34 million in locked user funds from its liquidity vault. The incident once again sparked concerns about pre-start agreements that held millions of dollars in customer deposits before deals began. It also demonstrates how stolen cryptocurrencies can quickly move across multiple blockchains, making recovery increasingly difficult.

According to official statements from blockchain security companies PeckShield and Cascade, the attack targeted the platform's Cascade Liquidity Strategy (CLS) vault on Arbitrum.

PeckShield reported: "Attackers transferred stolen funds from the Arbitrum Bridge to Solana, which then bridged to Ethereum in the form of DAI via Relay Protocol."

The agreement admitted Cascade exploit and said it was investigating the incident while tracking stolen assets.

Source: XCascade exploit follows a carefully planned money-laundering route

Cascade exploits are carried out through a series of cross-chain transactions designed to cover the attacker's tracks. On-chain data shows that the 1.34 million stolen USDC were first transferred from the compromised vault to an Arbitrum wallet and then to a second wallet. Subsequently, the attacker transferred the entire balance to Solana, exchanged the USDC for DAI, and sent the funds back to Ethereum through Relay Protocol. Once they arrived at Ethereum, the funds arrived in two deposits: 801,212 DAI and 536,000 DAI, totaling approximately 1.33 million DAI. The second transfer was later divided into three wallets, holding 178,000 DAI, 178,000 DAI and 180,000 DAI respectively. Investigators believe these cross-chain transfers were designed to make stolen funds more difficult to track.

Security experts also pointed out that converting USDC to DAI is a common strategy after DeFi exploits, because Circle can freeze stolen USDC, while DAI cannot be blacklisted by centralized issuers.

Lock deposits so that users cannot exit

Cascade exploits hit users particularly hard because CLS vaults contain pre-allocated deposits from Cascade's invitation-only "first wave" of activity. According to project documents, CLS serves as the protocol's native liquidity strategy, supports orderbook depth and clearing processes, and rewards early participants with points before public launch. Users deposit USDC on Arbitrum in anticipation of future incentives, but the funds remain locked up until the transaction goes online. This means that affected users cannot withdraw funds before the exploit occurs. Cascade also expanded CLS coffers in early 2026 by gradually raising the deposit cap, followed by opening the final $5 million distribution window on Jan. 21 to bring more eligible users into the program.

Strong financial backing failed to prevent exploit

Prior to Cascade exploit, the project attracted significant investor interest. Cascade received a $15 million seed round in December 2025 led by Polychain Capital and Variant. The startup, which bills itself as a new type of broker, plans to offer round-the-clock perpetual trading of cryptocurrencies, commodities, and tokenized pre-IPO shares of companies including OpenAI, SpaceX, and Stripe. Its main network was originally scheduled to be launched in the first quarter of 2026. Despite strong financial support, Cascade has not disclosed the technical reasons for the exploit. The investigation is still ongoing, and security companies continue to monitor wallet activity on multiple networks.

Another DeFi exploit, industry tough month continues

The Cascade exploit occurred less than two days after Ostium suspended trading after losing approximately $18 million due to oractor-based exploits. This timing is noteworthy because The Block has previously compared Cascade's licensing marketing strategy to Ostium's model. Recent DeFi exploits also occurred in the wake of Lazy Summer Protocol (which lost more than $6 million due to stock price manipulation vulnerability) and Bonzo Finance on Hedera (which lost $9 million due to oracle exposure). Together, these incidents highlight a worrying trend that attackers continue to target complex liquidity systems that hold large amounts of user funds. Cascade exploit reminds us once again that rapid innovation must be accompanied by greater security. As decentralized finance develops, protocols require rigorous testing, continuous monitoring, and transparent communication to protect users and maintain trust in an increasingly competitive market.

Conclusion

Cascade exploit shows that even well-funded encryption projects remain fragile if security fails to keep pace with innovation. While investigators continue to track stolen funds, the incident highlights the growing challenges faced in protecting assets that move across multiple blockchains in minutes. For investors, the lesson is clear: strong financial support and ambitious plans can never replace prudent risk assessment. For developers, every DeFi exploit reminds us that continuous auditing, real-time monitoring, and transparent communication are crucial to building lasting trust in decentralized finance.

Glossary of Key Terms

CLS: Cascade's liquidity vault for user deposits.

DeFi: Blockchain-based financial services without intermediaries.

DAI: A decentralized stablecoin that cannot be centrally frozen.

Relay Protocol: A protocol used to transfer assets across blockchains.

Arbitrum: Ethereum Layer 2 network that provides faster, lower-cost transactions.

Frequently Asked Questions about Cascade Explosions

What is a Cascade exploit? $1.34 million exploit against Cascade CLS vault.

Why use DAI? DAI cannot be centrally frozen like USDC.

Can users withdraw money? No. Deposits were locked before the vulnerability was exploited.

Is the investigation still ongoing? Yes. Cascade is continuing its investigation.