Decentralized finance (DeFi) platform Arcadia Finance has fallen victim to a significant exploit, resulting in the theft of approximately $2.5 million in cryptocurrency. The attack, which occurred on July 15, 2025, saw funds converted to Wrapped Ethereum (WETH) and bridged to the Ethereum mainnet. This incident marks another challenge for the platform, which previously experienced a hack in 2023.
Arcadia Finance Suffers $2.5 Million Exploit
Arcadia Finance, a liquidity management platform operating on the Base blockchain, confirmed an exploit on July 15, 2025. The attack targeted a vulnerability within the platform's Rebalancer contract, specifically by manipulating swapData parameters. This allowed the attacker to execute a rogue swap, draining assets from user vaults.
Blockchain security firm Cyvers reported that the exploit unfolded rapidly, with the attacker deploying a malicious contract and initiating the theft within a minute. The stolen assets, primarily USDC and USDS, were subsequently converted to WETH on the Base network and then bridged to the Ethereum mainnet. PeckShield, another blockchain security firm, noted that approximately 840 ETH, valued at around $2.5 million, was siphoned off.
Immediate Response and User Advisory
Following the detection of the unauthorized transactions, Arcadia Finance promptly issued an alert via X (formerly Twitter), advising users to take immediate action to mitigate further risks. The platform paused liquidity-related operations and urged users to revoke permissions for their asset managers and remove active rebalancers.
-
User Actions Recommended:
-
Remove all permissions for asset managers.
-
Remove active rebalancers.
-
Cyvers also recommended blacklisting the involved addresses on both Base and Ethereum, notifying major exchanges and bridges to halt inbound transactions, and sharing suspicious activity reports with law enforcement to aid in recovery efforts and prevent further illicit movement of funds.
Financial Impact and Broader Context
The exploit resulted in the loss of approximately 2.3 million USDC and 227,000 USDS, totaling around $2.5 million. The attacker received 199 WETH and 965.8 million AERO tokens during the swap process, impacting 12 addresses.
This is not the first security incident for Arcadia Finance; the platform experienced a $455,000 hack in July 2023 due to a code vulnerability. The current incident contributes to a concerning trend in the crypto space, with over $2.47 billion lost to hacks, scams, and exploits in the first half of 2025 alone. Despite these challenges, Arcadia Finance, backed by Coinbase Ventures and a recent member of the Circle Alliance, held a Total Value Locked (TVL) of $20.6 million at the time of the exploit, with USDC comprising over a third of its TVL.
Sources
-
Arcadia Finance Hacked for $2.5M: Can It Recover?, Coinspeaker.
-
Arcadia Finance Suffers $2.5M Exploit on Base; Funds Converted to WETH, Cointelegraph.
This article was created with support from AI-driven technology, drawing on multiple reputable sources. The final content has been thoroughly reviewed and edited by BlockzHub's editorial team to ensure accuracy, clarity, and coherence. Original reporting sources are credited whenever appropriate and as required. The opinions expressed in this article do not necessarily represent the official views or positions of BlockzHub. This article is intended for informational purposes only and should not be considered financial or professional advice. Investing involves risk, and you should consult a qualified financial advisor before making any investment decisions.