DeFi Platform ArcadiaFi Exploited for $2.5 Million in Crypto Asset
Arcadia Finance, a DeFi platform operating on the Base blockchain, has suffered a significant security breach, resulting in the loss of approximately $2.5 million in digital assets.
In yet another blow to the DeFi ecosystem operating on a base blockchain, Arcadia Finance has fallen victim to a security breach that resulted in the loss of approximately $2.5 million in digital assets, coinciding with a strong market upswing.
How the ArcadiaFi Exploit Happened
According to blockchain security firm Cyvers, the exploit targeted Arcadia’s rebalancer feature, a core tool for managing liquidity across decentralized exchanges. Therefore, the breach stemmed from a flaw in Arcadia’s Rebalancer contract.
The attacker manipulated the swapData input, initiating unauthorized swaps that drained funds from user vaults. Cyvers further revealed that the incident began early Tuesday at 04:05 UTC. Within moments, the threat actors deployed a malicious contract, executing the exploit and swiftly converting the stolen assets into Wrapped Ethereum (WETH) on Base before bridging the funds to Ethereum’s mainnet.
The team swiftly issued a warning on X (formerly Twitter), urging users to revoke permissions granted to asset managers and disable any active rebalancers to prevent further damage.
More Reports on the Crypto Assets Hack
Blockchain security firm Peckshield also reported that the attack resulted in approximately 840 ETH, which, at the time of writing, is worth around $2.5 million, from Arcadia’s deployment on the Base network. The stolen funds have since been bridged to Ethereum and linked to Tornado Cash, a sanctioned crypto mixer often associated with laundering illicit crypto assets. ETH is currently trading at $2,980.
This is not the first time that the DeFi platform has experienced such a breach. Back in July 2023, Arcadia suffered a $455,000 exploit due to a smart contract flaw.
Despite its security struggles, Arcadia Finance has backing from major players, including Coinbase Ventures, and has recently joined the Circle Alliance. According to its website, USDC accounts for more than one-third of its total value locked (TVL). Current data from DeFiLlama places Arcadia’s TVL at approximately $20.6 million.
The hack adds to a growing list of DeFi attacks. In the first six months of 2025 alone, over 75 incidents have been recorded, with total losses surpassing $2.1 billion, highlighting the persistent vulnerabilities in the crypto space. Arcadia Finance has not yet issued a full post-mortem but has promised further updates.
