Arcadia Finance Hit by $3.5 Million Crypto Hack After Rebalancer Contract Breach

Highlights:

• Arcadia Finance lost $3.5 million after a rebalancer exploit allowed attackers to drain funds from user vaults.
• The stolen assets moved from Base to Ethereum and passed through Tornado Cash to hide transaction trails.
• Arcadia urged users to revoke permissions and pause contracts while working with security firms and authorities.

Arcadia Finance, a decentralized finance platform on the Base blockchain, suffered a major security breach today. The attacker targeted Arcadia’s Rebalancer contract by manipulating swap data parameters. This vulnerability allowed the attacker to initiate unauthorized swaps and remove assets from user vaults. According to blockchain security firm Cyvers, the exploit started at 04:05:58 UTC. The attacker used less than a minute to deploy a malicious contract and exploit it.

Advertisement

#PeckShieldAlert @ArcadiaFi has been exploited, resulting in a loss of ~$2.5M in crypto. The exploiter has swapped the stolen funds for ~840 $ETH & bridged them from #Base to #Ethereum https://t.co/pOV82RR5YC pic.twitter.com/BKMvgaDiDI

— PeckShieldAlert (@PeckShieldAlert) July 15, 2025

The hacker exchanged the tokens for Wrapped Ethereum (WETH) and cross-chained them to the Ethereum mainnet. Twelve addresses were involved in the operation and received 199 WETH and 965.8 million AERO tokens. A total of $2.5 million worth of mostly USDC and USDS were stolen, with around 2.3 million in USDC and 227,000 in USDS. Cyvers indicated that the stolen proceeds are currently behind new intermediary wallets on the Ethereum.

Arcadia was attacked again shortly after the initial incident. The second hack resulted in losses of nearly $1 million over several transactions. The two incidents resulted in a total loss of approximately $3.5 million. According to PeckShield, the stolen funds were bridged out of Base into Ethereum and moved through Tornado Cash.

🚨UPDATE🚨@ArcadiaFi attacker has just executed another ~$1M from #arcadia in multiple transactions!

Want to secure your assets and prevent future attacks? Book a Demo today! https://t.co/vDCEKjRHz3 #CyversAlert https://t.co/Yh3VCETX0z pic.twitter.com/4g0qT9SXG9

— 🚨 Cyvers Alerts 🚨 (@CyversAlerts) July 15, 2025

Rebalancer Vulnerability Puts DeFi Liquidity Platform in Crisis

The Arcadia team reacted within a short time and raised an alert to the public on X. The platform encouraged users to cancel all permissions associated with asset managers and to disable rebalancers. The steps served to block any additional unauthorized transactions. Arcadia also halted its smart contracts to preserve outstanding funds and evaluate the situation with the assistance of security specialists.

The team is aware of unauthorized transactions via a Rebalancer.
Remove all permissions for asset managers.
More information will follow.

— Arcadia Finance (@ArcadiaFi) July 15, 2025

The recent breach is not the first security incident at Arcadia Finance. Another vulnerability in its code led to a loss of $455,000 two years ago. These recurring breaches have raised fresh concerns over the platform’s contract safety. As of press time, Arcadia holds a total value locked (TVL) of $7.44 million, according to DefiLlama data. Over one-third of its assets are held in USDC.

Hacks and exploits remain a threat to user funds across the DeFi sector. More than 75 distinct events resulted in an excess of $2.47 billion in losses in the first half of 2025. Meanwhile, according to a report by Immunefi, the total losses from crypto hacks amounted to $92 million in April. The DeFi sector was the most hit within the month. Other notable exploits include the Force Bridge, where the platform lost $3 million.

Crypto Hack Raises Security Concerns in DeFi

The platform has reached out to security agencies and security companies to help track down the stolen funds. The platform has suspended all contracts and has requested users to take urgent protective measures. Cyvers has recommended that exchanges and bridges embargo the addresses associated with the hack. The company also encouraged team members to report on suspicious activities to investigators. Arcadia Finance has not yet announced when the services will resume fully.

Advertisement