The Empowa DeFi platform, operating in the Cardano ecosystem, identified unauthorized transfers from three addresses controlled by the project. The Empowa team believes that the attacker may have gained access to the private keys of these wallets and used them for an extended period.
What Is Empowa
Empowa is a DeFi platform in the Cardano ecosystem, focused on financing affordable housing in Africa. Its model combines blockchain infrastructure, real estate investment, mortgage and rent-to-own approaches, as well as payments in local currency, allowing local participants to access funding through cryptocurrency infrastructure.
The EMP token plays a key role in the Empowa ecosystem. It is used within the project and is tied to its economic model, while the platform itself operates at the intersection of DeFi, real-world asset tokenization, and affordable housing initiatives.
The core idea for the RWA direction is simple: real assets related to real estate or payment flows receive digital representation on the blockchain. Compared to other RWA projects, Empowa stands out for its narrow specialization—focusing on housing, emerging markets, and applied financial instruments, rather than abstract asset tokenization.
The community can follow Empowa’s progress through the project’s official channels and Cardano on-chain data, where token movements and related address activity are reflected.
ADA and NIGHT Withdrawn From Treasury Wallet
The first episode is related to the Empowa treasury address on the Cardano network. From November 2025 to June 2026, 143,710 ADA were withdrawn from it. The same wallet held 48,219 NIGHT tokens, received through the Midnight project airdrop. Empowa representatives stated that the team was unaware these NIGHT tokens were stored at the address.
Some of the NIGHT tokens remain inaccessible: a quarter of the amount is locked, and an additional signature is required for withdrawal. Suspicious operations began on November 26, 2025, although the address itself was previously considered locked. Therefore, Empowa suggests that access to the keys was obtained even before the first ADA transfers.
Most of the stolen ADA passed through an intermediary address. Then, an unknown party deposited 100,000 ADA into the Liqwid lending protocol and took out USDCx against this collateral. After that, some assets were exchanged for stablecoins and withdrawn from Cardano via cross-chain bridges.
Second Episode Involved EMP Tokens
Another incident is related to the addresses $ and $ , where undistributed EMP was stored. From June to August, 4.24 million EMP were transferred from these wallets.
According to Empowa, about 850,000 EMP were sold for ADA on Minswap and VyFi. The ADA received was then converted to USDCx. Of this amount, 4,810 USDCx went to the same intermediary address that appeared in the treasury wallet story. Some of the remaining EMP, according to the team, is still circulating on Minswap.
Empowa Does Not Link Theft to SecondFi Hack
The Empowa team rules out any connection to the June attack on SecondFi in the Cardano ecosystem. At that time, attackers exploited a cryptographic vulnerability in the wallet and stole 16.1 million ADA worth $2.6 million from 374 client addresses.
In Empowa’s case, suspicious activity began back in November 2025, several months before the SecondFi attack. In addition, the affected addresses were corporate, not user wallets created through a browser.
Based on the nature of the transactions, the team concluded that the same person controlled the private keys for an extended period. This participant registered the treasury wallet to participate in Glacier Drop Midnight, received NIGHT as it was unlocked, and then transferred ADA and NIGHT to third-party addresses.
Investigation Ongoing
Blockchain analytics specialists have been brought in for the investigation. Empowa continues to monitor wallets associated with the withdrawal of funds and intends to request client data through official legal procedures if the stolen cryptocurrency reaches centralized exchanges. A separate focus of the investigation is access to private keys, internal roles, and points through which transaction signatures could have passed.
The team admits that an insider may have been involved in the transfers, but there is no confirmation of this version yet. Such incidents are especially sensitive for DeFi projects: a key leak affects not only current payments but also investor trust in the infrastructure, where cryptocurrency, collateral, portfolio assets, and market liquidity are interconnected.
For Empowa, this risk is particularly noticeable due to the project’s connection to affordable housing, real estate, mortgage mechanisms, local payments, and the rent-to-own model in Africa. Therefore, security here becomes not a technical detail, but a factor in the sustainability of the entire financial model.
A similar stir was recently caused by an attack on the Liquid Network. Unknown individuals, calling themselves white hat hackers, withdrew 4,000 Bitcoin worth $320 million. Later, they returned 3,400 Bitcoin to the network wallet, keeping 598 BTC for themselves.
