July 15, Arcadia Finance, a liquidity management platform for decentralized crypto exchanges, was exploited, resulting in a loss of about $3.6 million in crypto assets. The hackers targeted one of the platform’s key features, the rebalancer on the Base network.

Focus Area

Arcadia Finance Hack Bounty Program

Introduction

On July 15 2025, Arcadia Finance, a liquidity management platform for decentralized crypto exchanges, was exploited, resulting in a loss of about $3.6 million in crypto assets. The hackers targeted one of the platform’s key features, the rebalancer on the Base network. A 10% reward will be granted if the information provided leads to the recovery of stolen funds. Anyone with relevant intel — including names, locations, or verifiable evidence — is encouraged to contact us.

Timeline and Initial Steps Taken

July 14th 2025 - 09:22:03 AM UTC - Attacker Triggers Circuit Breakers The presumed exploiter deployed 2 malicious contracts through address 0xeF35e80Bd9e806A47d468f25CD38a1e63541caB4.

Contract 1: 0x87730d2c2A2D453d3E2248Fd7360D31FEf9c7f04 Contract 2: 0x35a717e88583B2CC1789912C92A57C202ae7d585

These contracts triggered the circuit breakers of the Arcadia Finance core protocol in real time when Contract 1 was deployed, thanks to a Hexagate alert. The protocol was fully paused at 09:22:13 AM UTC.

The team was notified straight away and assessed the deployed contracts by 0xeF35. Upon review by the core team, together with external security experts, these contracts in their current state were evaluated as very suspicious yet not harmful to the protocol and its users.

Simulations on forked networks were performed to mimic the state of the unpaused protocol and assess all possible function calls in the two contracts. No non-reverting actions were found and additional tests and deploy scripts to mimic these contracts were written to confirm additional vectors.

Simulations of all function calls on the malicious contracts in non-paused state:
https://www.tdly.co/shared/simulation/bf611343-ccdd-4684-acd9-3ec62c95239a
https://www.tdly.co/shared/simulation/a680d742-0225-4479-b4e7-b4bdceb43de8
https://www.tdly.co/shared/simulation/eb9a3f30-98aa-4308-8cf3-444080c6ccb5

After careful review the decision was made to unpause the majority of the protocol, keeping only borrows paused to mitigate any further attempts to exploit Arcadia lending pools.

July 14th 2025 - 13:05 AM UTC - Protocol Is Partially Unpaused

The unpause is executed, approximately 4 hours after the circuit breakers were triggered. After this unpause, the protocol remained locked for additional borrows, as the two deployed contracts had a vector entry into the lending pools. The team continued to write additional tests specific for any path these contracts touched.

The protocol pausing and unpausing played a significant role in the subsequent attack the next day. Arcadia is designed to be resilient against rogue developers and includes a mechanism to prevent developers from pausing the protocol indefinitely and locking all user funds. Only after a fixed “coolDownPeriod” can the protocol be paused again. During the “coolDownPeriod”, the protocol cannot be paused again, even if the circuit breaker is triggered by a new threat. The attacker used this mechanism to its advantage, his initial trigger of the circuit breakers acting as bait to lock the protocol into an unpaused state. This prevented the team from pausing the protocol, when the real attack began.

July 15th 2025 - 04:05 AM UTC - Attacker Starts His Exploit

At 04:05 AM July 15th, exploiter 0x0fa54E967a9CC5DF2af38BAbC376c91a29878615 began a series of transactions that led to the eventual exploit as detailed further.

The team was notified at 04:05 AM when the malicious contract was deployed thanks to a Hexagate alert. But even though this tried to trigger the circuit breakers, due to the pause-unpause limitation, the protocol could not be sufficiently paused to prevent stolen funds.

SEAL Alliance was contacted at 04:25 AM and our security partners where brought up to speed while the root cause was actively investigated.

At 04:25 AM, an initial message from the core team was sent on Discord urging users to revoke permissions to asset managers. Direct messages were sent to users of whom the core team knew their accounts might be at risk, followed by a general message on X at 04:57 AM.

The team decreased asset exposures to zero, causing the attackers current flow of exploit transactions to be momentarily halted. However, the attacker adapted his exploit transactions to circumvent this measure.

At 10:36 AM, an initial message was sent to the exploiter, offering a 10% white-hat bounty upon returning the funds within 24 hours, and offering a public bounty for that amount after.

The exploiter currently holds $3.6m in ETH, on ETH Mainnet and Base.

Root Cause

The exploit worked as follows:

The attacker created a number of Arcadia Accounts, which were used as his attack base. https://basescan.org/tx/0xeb1cbbe6cf195d7e23f2c967542b70031a220feacca010f5a35c0046d1a1820a

The attacker then combined a series of functions in a flashaction to interact with his Accounts, with the Rebalancer contracts and with Morpho:

The attacker takes three Morpho flashloans of approx $1.5 billion.
The attacker links the Asset Manager to his account, with himself set as the initiator.
The attacker creates a small LP position.
The attacker repays all the debt of the victim account using the Morpho flashloans.
The attacker triggers a rebalance for his own LP position, injecting custom calldata.
Instead of rebalancing through a DEX aggregator, the attacker uses the custom calldata to abuse a missing validation and call the victim Arcadia Account from within the Asset Manager, as if the Asset Manager itself called it.
The attacker, after calling the victim Account, was able to withdraw the position, decompose it, and steal owner funds.
Since the target Account had no open debt anymore, the Account ended in a healthy state, causing the transaction to succeed instead of triggering a failsafe.
Part of the stolen funds are swapped to repay the flashloans.
The remaining funds stay on the attackers contract, which he can withdraw in a separate transaction.

https://dashboard.tenderly.co/tx/0x06ce76eae6c12073df4aaf0b4231f951e4153a67f3abc1c1a547eb57d1218150 Example transaction

The Attack in more detail.

The root cause of the exploit is the fact that the malicious attacker could hijack the msg.sender of the Asset Manager to call a target Arcadia Account, who had set the Asset Manager as allowed asset manager. To mitigate this vulnerability, a check should have been performed that the router is not an Arcadia Account. Or even better, the swap via a router should have been called from an intermediate smart contract, that has no permissions anywhere on Arcadia Contracts.

References

unpause: https://basescan.org/tx/0x38b744e967e6d6ed8870619ac2f35b6d5612a396eaf3ba981ed754c7395c310d#eventlog
pause: https://basescan.org/tx/0x23c3796c42dbca0148975729a5f2dddf539c4c7a8284289e12190fbd5a6c091b
contact initiation: https://basescan.org/tx/0x97cdd4a7ec02088b63291a1484d275f6e9279eac972ea069637a060e72b6362b https://etherscan.io/tx/0xb1025d7313de0283b1a9cae514e207541d4f45bbc1cf2800f6e3aba0a35b878b
Exploiter: https://basescan.org/address/0x0fa54e967a9cc5df2af38babc376c91a29878615
Possible connected wallet ( triggered pause mechanism ): https://basescan.org/address/0xeF35e80Bd9e806A47d468f25CD38a1e63541caB4
- contract deployment that triggered guardians: https://basescan.org/tx/0x0b2b055a4900a8b6c1f21e7c188811e0d67ead3eaa6f7c2c5242f0d4817b32e0

Legal & Ethical Considerations

All submitted intelligence must comply with applicable laws and ethical standards.
Do not engage in unauthorized access, exploitation of systems without consent, or any activity that violates the law.
Reports must not include personally identifiable information (PII) obtained through unlawful or unethical methods.
Rewards are subject to internal verification and compliance review.
High-value rewards may require Anti-Money Laundering (AML) and Know Your Customer (KYC) verification.

Arcadia Finance Hack Recovery Program: Program info

Arcadia Finance Hack Recovery Program