Orange Finance Hack

Orange Finance ran automated vaults on Arbitrum that managed liquidity positions on exchanges such as Uniswap, PancakeSwap and SushiSwap. Users deposited tokens into these vaults, which required approving the vaults to move their tokens. On 7 January 2025, an attacker took control of the team's admin wallet. It was meant to be a multisig that needs several team members to sign off, but it had been set up to accept just one signature, so a single leaked private key was enough.

The attacker made themselves the owner of every vault, swapped in malicious code and withdrew the deposited tokens. They then used the same code to pull tokens from wallets that still had approvals for the vaults. According to Orange, about $784k came from deposits, $47k from approvals and $12k from unclaimed rewards. Orange disabled deposits and withdrawals on its website, brought in the security group SEAL 911 and offered the attacker a deal to return the funds. Nearly half of the vaults' funds sat in the Stryke protocol, where they were paused in time.

Orange said the root cause was poor key management and missing internal controls, not a bug in its smart contracts. It said it would publish each wallet's losses and then share details on recovery and compensation. The attacker took ownership of the vault contracts, so any approval still given to them can be used to take the approved tokens. If you ever used Orange Finance, revoke your approvals to its vaults on Arbitrum. Revoking protects what is still in your wallet but does not recover lost funds.

Affected users remain at risk as long as they haven't revoked their approvals, so it is recommended to use the Revoke.cash Exploit Checker below to make sure that you're safe.