Arcadia Users Lose $3.5M as Exploit Strikes Platform Twice

Crypto News Exploits

Arcadia Finance Users Lose $3.5 Million as Exploit Strikes Platform Twice

Written by Aaron S.,

Editor-In-Chief

Last Updated: July 15, 2025

Key Takeaways

Arcadia Finance lost $3.5 million after a July 15 exploit targeted its Rebalancer contract;
The attacker used custom swap data to drain funds, then bridged WETH to Ethereum;
Arcadia Finance warned users to revoke Rebalancer permissions to reduce further risk.

Stop overpaying - start transferring money with Ogvio. Join the waitlist & grab early Rewards NOW! 🎁

Arcadia Finance Users Lose $3.5 Million as Exploit Strikes Platform Twice

BITDEGREE IN YOUR SOCIAL FEED

The decentralized finance (DeFi) platform Arcadia Finance was targeted in an attack that led to the loss of around $3.5 million in crypto assets.

The issue came from a weakness in the platform’s Rebalancer contract. According to a report by Cyvers, the attacker exploited a part of the contract that allows users to input custom swap data.

On July 15, the attacker deployed a malicious contract, which triggered the exploit within under a minute. After taking the funds, they exchanged them for Wrapped Ethereum WETH $2,914.17 on the Base chain. They then transferred the WETH to Ethereum’s ETH $2,915.41 main network using a bridge.

What Is Tether? (USDT SIMPLY Explained With Animations)

Did you know?

Want to get smarter & wealthier with crypto?

Subscribe - We publish new crypto explainer videos every week!

The tokens taken in the first round included about 2.3 million USDC USDC $0.9998 and 227,000 USDS, which made up roughly $2.5 million of the loss. During the exchange process, the attacker also received 199 WETH and almost 966 million AERO tokens. These were spread out across twelve affected wallets.

After the initial breach, Arcadia was hit again. This second round of theft happened through multiple transactions and took nearly another $1 million.

The Arcadia Finance team confirmed the issue through a post on X, which reads:

The team is aware of unauthorized transactions via a Rebalancer. Remove all permissions for asset managers. More information will follow.

The platform also asked users to take action by canceling any permissions tied to the Rebalancer contract to avoid further risks.

On July 9, GMX's first-generation decentralized exchange (DEX), GMX V1, was temporarily suspended from trading. What happened? Read the full story.