Decentralized perpetuals trading platform Cascade.xyz has suspended trading and withdrawals after suffering a $1.34 million exploit that drained funds from its CLS vault.
Blockchain security firm PeckShield reported the incident on July 16, revealing that the attacker stole approximately 1.34 million USDC from the protocol’s vault on Arbitrum before moving the funds across multiple blockchain networks in an apparent effort to conceal their origin.
#PeckShieldAlert @cascade_xyz has reported that they suffered an exploit affecting the CLS vault, resulting in 1.34M $USDC being drained from user funds.
The exploiter has bridged the stolen funds from #Arbitrum to #Solana, and then bridged them to Ethereum via @RelayProtocol… pic.twitter.com/JsDq5lf43U
— PeckShieldAlert (@PeckShieldAlert) July 16, 2026
Cascade has acknowledged the incident and temporarily halted platform operations while the investigation continues.
How were the stolen funds moved?
According to PeckShield, the attacker quickly bridged the stolen USDC from Arbitrum to Solana before transferring the assets to Ethereum through RelayProtocol.
Once on Ethereum, the funds were swapped into DAI, a move commonly used in an attempt to make stolen assets more difficult to trace. On-chain data also showed the funds being split into separate wallets, with transfers of about 801,000 DAI and 536,000 DAI sent to different addresses.
The movement across several blockchains shows a common trend among crypto attackers, who use cross-chain bridges and token swaps to complicate tracking efforts by investigators.
RELATED: Taiko Halts Bridge Operations After $1.7 Million Exploit
What is the CLS vault and what happened?
Cascade.xyz is a decentralized perpetual futures platform that allows users to trade with leverage. The CLS vault is part of the protocol’s system for managing user funds and liquidity.
The exact cause of the exploit has not been disclosed, and neither Cascade nor security researchers have identified the vulnerability that allowed the attacker to access the funds.
The protocol is backed by major crypto investors, including Polychain Capital and Variant, but the incident shows that even well-funded DeFi projects remain exposed to smart contract and infrastructure risks.
Investigation underway as platform suspends operations
Following the exploit, Cascade suspended trading and withdrawals to prevent additional losses while its team investigates the attack. The identity of the attacker remains unknown, and there is no confirmation that any of the stolen funds have been recovered.
The exploit adds to an increasing number of DeFi security incidents in 2026, many of which have involved attackers moving assets across multiple blockchain networks shortly after stealing them. Cascade is expected to release further updates once its investigation is complete.
The Cascade incident comes barely a day after Ostium, another Arbitrum-based perpetuals platform, paused all trading following an oracle-based exploit that drained an estimated $18 million in USDC from its OLP vault. Additionally, Hinkal has frozen affected smart contracts after reports of unusual on-chain activity involving USDC on Ethereum and other supported networks, as the privacy-focused protocol investigates a suspected exploit.
Enjoyed this? Bookmark DeFi Planet, explore related topics, and follow us on Twitter, LinkedIn, Facebook, Instagram, Threads, and CoinMarketCap Community for seamless access to high-quality industry insights
Take control of your crypto portfolio with DEFI PLANET PRO, DeFi Planet’s suite of analytics tools.
