Cardano-based DeFi platform Empowa has disclosed unauthorized transfers from three project-controlled wallets, revealing that an unauthorized party gained access to the wallets' private keys.
ADA Treasury Wallet Compromise
Between November 2025 and June 2026, 143,710 ADA was moved from Empowa's Cardano treasury wallet. The wallet also contained 48,219 NIGHT tokens claimed from Empowa's Midnight airdrop allocation. Empowa stated that the unauthorized activity began on November 26, 2025, despite the wallet being considered initially locked.
Most of the transferred ADA passed through an intermediary wallet, which deposited 100,000 ADA into the Liqwid lending protocol as collateral. The intermediary wallet then borrowed USDCx against the collateral, converted funds into stablecoins, and moved them off Cardano through transactions consistent with cross-chain bridge redemptions.
EMP Token Transfers
Between June and August 2026, 4.24 million EMP tokens were transferred from the $empowa.public and $empowa.ispo wallets, which held undistributed EMP tokens. Approximately 850,000 EMP moved during the initial phase and was subsequently sold for ADA on Minswap and VyFi. The resulting ADA was converted into USDCx, with 4,810 USDCx sent to the intermediary hub linked to the treasury wallet incident.
Connection to Other Incidents
Empowa clarified that the unauthorized transfers were unrelated to the SecondFi security incident disclosed in June 2026, when hackers siphoned 16.1 million ADA from 374 user wallets after exploiting a flaw in SecondFi's wallet-generation software. Empowa noted that its treasury wallet showed unauthorized activity as early as November 2025, several months before the SecondFi incident became public.
Empowa emphasized that the affected wallets were enterprise addresses controlled by the project's backend rather than consumer wallets generated through browser software. The activity instead indicates deliberate and sustained control of the private keys, including the registration of the treasury wallet for Midnight's Glacier Drop and the subsequent movement of ADA and NIGHT through other wallets.
Ongoing Investigation
Empowa has engaged blockchain investigators and continues to monitor the affected wallets. The project plans to pursue KYC information through legal channels if the stolen funds reach centralized exchanges.
