Arcadia Finance, a decentralized finance platform, fell victim to a hack that resulted in the loss of around $2.5 million in cryptocurrency. The incident occurred on the Base blockchain.
Incident Overview
On July 15, 2025, at 04:05:58 UTC, Arcadia Finance experienced a significant security breach. Approximately $2.5 million was stolen, including 2.3 million USDC and around 227,000 USDS, which were converted into Wrapped Ethereum (WETH) on the Base network.
Attack Execution
The attack targeted the protocol's Rebalancer contract, exploiting a vulnerability that allowed the attacker to manipulate swapData parameters and execute unauthorized swaps. According to blockchain security firm Cyvers, the attacker deployed a malicious contract and completed the exploit in under a minute.
Response from Arcadia Finance and Prevention
In response to the hack, Arcadia Finance confirmed the incident via a post on X (formerly Twitter), urging users to immediately revoke any asset manager permissions granted to Rebalancer contracts. They reassured users that they are investigating the incident and will release more information soon.
With the rise in cyberattacks and cryptocurrency thefts in 2025, users are advised to stay updated on official communications and exercise caution with permissions on DeFi platforms.
