Arcadia V2 Hack

On July 15, 2025, Arcadia Finance (@ArcadiaFi) — a liquidity and asset management protocol — was exploited for approximately $3.5 million on Base. The attacker leveraged a critical trust assumption flaw in the RebalancerSpot contract, exploiting a swapData parameter that allowed arbitrary external calls to unvalidated router addresses. The stolen funds were swapped to ETH and bridged to Ethereum, where they currently reside.

The attacker funded address 0x0fa54…8615 via Tornado Cash on Ethereum, then bridged ETH to Base and took a ~$1.5 billion flashloan from Morpho Blue to fund the exploit. The root cause lies in the lack of validation in the SwapLogic._swapViaRouter() function, which allowed the attacker to inject a malicious router via the router.call(data) mechanism.

By registering their own malicious smart contract as both the router and a whitelisted ArcadiaAccount, the attacker spoofed privileged execution contexts. They first repaid debts of target victim accounts to bring them to a "healthy" state, then called rebalance() with carefully crafted swapData that encoded their malicious router address and payload.

Inside SwapLogic._swapViaRouter(), the malicious contract was called from the Rebalancer's context (msg.sender == Rebalancer), inheriting elevated privileges since the Rebalancer was already whitelisted in victim accounts. This allowed unauthorized withdrawals of LP tokens from victim accounts, bypassing all access control mechanisms.

Approximately 840 ETH was bridged back to Ethereum via Across, and the flashloan was repaid using part of the stolen funds. Arcadia has paused contracts, urged users to revoke asset-manager approvals, and offered a 10% white-hat bounty if 90% of funds are returned within 24 hours.

Attacker address:

0x0fa54e96…878615

Exploit transactions:

0x06ce76ea…218150

0x0b9bed09…62d60b

Bridge-out transaction:

0x562c0842…5e25a3