AARK (Aark Digital) Hack

On October 25, 2024, Aark Digital, a perpetuals DEX on Arbitrum, lost 1,499,841 USDC and 159.09 ETH, about $1.9 million, after an incorrect balance update inflated one account's value by a factor of about 10^18. Aark first reported the loss as 1,386,085.5 USDC and 24.143 ETH and revised it upward on October 28. The stolen funds were about 67% of all deposits, including futures collateral and LP funds.

The bug came from an operational fix rather than a flaw in a deployed contract. After a GM token burn failed with a callback error, which SlowMist attributes to a change in a third-party contract, Aark upgraded its contracts, delisted GM, and ran a script to convert users' GM balances to USDC. During that run one user's USD value jumped from 0.498942 to 498,942 × 10^12, and the attacker withdrew against it. Aark offered a 15% bounty for the funds' return, set up a recovery bounty on Arkham, and worked with exchanges including Binance and with law enforcement. It traced the funds to three wallets, suspended team salaries, and said it could refund 33% of affected users' deposits, with further monthly distributions as funds were recovered.