Arcadia Finance Users Lose $3.5 Million as Exploit Strikes Platform Twice

The issue came from a weakness in the platform’s Rebalancer contract. According to a report by Cyvers, the attacker exploited a part of the contract that allows users to input custom swap data.

On July 15, the attacker deployed a malicious contract, which triggered the exploit within under a minute. After taking the funds, they exchanged them for Wrapped Ethereum WETH $3,069.10 on the Base chain. They then transferred the WETH to Ethereum’s ETH $3,082.30 main network using a bridge.

Did you know?

Want to get smarter & wealthier with crypto?

Subscribe - We publish new crypto explainer videos every week!

How to Invest in Crypto: 6 Rewarding Strategies (Animated)

SUBSCRIBE

ON YOUTUBE

The tokens taken in the first round included about 2.3 million USDC USDC $0.9990 and 227,000 USDS, which made up roughly $2.5 million of the loss. During the exchange process, the attacker also received 199 WETH and almost 966 million AERO tokens. These were spread out across twelve affected wallets.

After the initial breach, Arcadia was hit again. This second round of theft happened through multiple transactions and took nearly another $1 million.

The Arcadia Finance team confirmed the issue through a post on X, which reads:

The team is aware of unauthorized transactions via a Rebalancer. Remove all permissions for asset managers. More information will follow.

The platform also asked users to take action by canceling any permissions tied to the Rebalancer contract to avoid further risks.

On July 9, GMX's first-generation decentralized exchange (DEX), GMX V1, was temporarily suspended from trading. What happened? Read the full story.