Arcadia Finance Hack

Arcadia Finance is a DeFi protocol on Base where users manage liquidity positions and borrow through their own Arcadia Accounts. It also offers optional automations, run by separate contracts, that rebalance and compound those positions for users. On 15 July 2025, an attacker found that one of these automation contracts did not properly check the swap instructions it was given, and used this to empty other users' accounts. A day earlier, suspicious contracts had triggered Arcadia's automatic safety pause. After the team checked them and unpaused, a cooldown period stopped it from pausing again when the real attack started.

The attacker took about $3.6M on Base in two waves, including USDC and USDS stablecoins, then swapped the funds to ETH, bridged it to Ethereum and split it across several addresses. Arcadia offered the attacker a 10% bounty through an on-chain message if the rest was returned within 24 hours, but the funds were not returned. Arcadia said its lending and token contracts were not affected. Insurer Nexus Mutual paid $250k to users who had bought cover through OpenCover, and Arcadia set out its own recovery plan based on recovery tokens for affected users.

Arcadia Accounts can move tokens that their owners have approved to them, and the automations act on those accounts. That is why the flaw could also reach tokens sitting in users' wallets, not just funds deposited in Arcadia. Arcadia therefore advised users to revoke all token approvals to their Arcadia Accounts and other Arcadia contracts, and to disable any active automations. If you have ever used Arcadia on Base, check for remaining approvals and revoke them. Revoking protects what is still in your wallet, but it does not recover assets that were already taken.

Affected users remain at risk as long as they haven't revoked their approvals, so it is recommended to use the Revoke.cash Exploit Checker below to make sure that you're safe.