Polychain Backed Cascade CLS Vault Exploit Drains $1.34M in USDC

MakeCryippreferred on

Approximately $1.34 million in USDC linked to a security incident involving Cascade’s CLS vault was transferred from Arbitrum before funds associated with the outflow were traced through Solana and Ethereum. Cascade reportedly suspended trading and withdrawals after the incident. On-chain security firm PeckShield later reported that the funds moved through multiple networks and were converted into DAI. The technical cause, recovery status and final impact on users remain unconfirmed.

Cascade suspends trading and withdrawals

A message attributed to Cascade Discord administrator MAX said the platform had paused all trading and withdrawals and contacted SEAL 911 and other third-party security teams to investigate. A separate publicly accessible Cascade statement was not available at the time of writing. It therefore remains unclear whether deposits, open positions or other Cascade products were also affected.

Initial information described approximately $1.3 million as user funds lost. However, Cascade has not published an accessible breakdown confirming whether that amount represents a vault outflow, a platform accounting shortfall or a permanent customer loss. The incident follows an active period for blockchain security, with 45 separate incidents and $76.51 million in disclosed losses recorded during June 2026. However, Cascade’s incident cannot yet be assigned to any specific attack category because its technical cause remains undisclosed.

Funds move across Arbitrum, Solana and Ethereum

On-chain data shows that 1,343,921.816016 USDC was transferred on Arbitrum at 10:34:15 PM UTC on July 15, equivalent to 4:04:15 AM IST on July 16. The transfer moved funds from 0x6b01…E99Ec to 0x285996…D9b55. The transaction was successful and carried a value of approximately $1.34 million at the time.

ZarvXBT later identified the Solana address Gkfyoj…RhejcX in connection with the fund movement. Relay’s transaction page for the full address provides a record for reviewing cross-chain activity associated with the wallet. PeckShield reported that funds linked to the incident moved from Arbitrum to Solana and were later transferred to Ethereum through Relay Protocol before being converted into DAI.

Cross-chain movement has also appeared in other recent security cases. In the Bonzo Lend oracle incident, part of the borrowed assets moved from Hedera to Ethereum, although the attack method and networks involved were different from the still-unexplained Cascade incident.

The use of Arbitrum, Solana, Ethereum and Relay does not indicate that any of those networks or services were compromised. Available information only shows that they were used during the movement of the funds. No verified public update has established where the DAI is currently held or whether any portion of the assets has been frozen, recovered or transferred again.

Cause and final losses remain unclear

Cascade has not released an accessible technical explanation identifying how the CLS funds were removed. There is currently no verified evidence showing whether the incident involved a smart-contract vulnerability, compromised private keys, administrator credentials, an access-control failure or another security issue.

The distinction is important because compromised private keys accounted for about 40% of historical crypto hack losses, while other incidents have resulted from contract logic and infrastructure failures. No evidence currently places the Cascade outflow in any of those categories. The platform has also not confirmed how many users were affected, whether the incident was limited to one CLS vault or whether reserves elsewhere could cover the outflow.

Cascade has been described as an invite-only, New York-based platform offering multi-asset perpetual markets and supporting deposits through Arbitrum USDC and bank accounts. However, the exact function of the CLS vault has not been publicly clarified through an accessible official source. At the time of writing, no accessible update had confirmed a reimbursement plan, recovery of the assets or when trading and withdrawals would resume.