Arcadia Finance Hit by $2.5 Million Exploit on Base Network

Arcadia Finance, a decentralized finance (DeFi) platform operating on Coinbase’s Base blockchain, has suffered an exploit leading to the theft of approximately $2.5 million in cryptocurrency, adding to the growing list of 2025 DeFi security breaches.

Blockchain security firm Cyvers reported that the attacker targeted Arcadia’s Rebalancer contract, exploiting a vulnerability by abusing arbitrary swapData parameters. This loophole allowed the attacker to execute a rogue swap, draining assets from user vaults. 

The exploit occurred on Tuesday at 04:05:58 UTC, with the attacker deploying a malicious contract and executing the drain within a minute, Cyvers shared in a report.

Following the exploit, the stolen tokens were quickly swapped for Wrapped Ethereum (WETH) on the Base network and bridged to Ethereum’s mainnet, where they were split across fresh intermediary addresses, indicating an attempt to fragment and obscure the funds, likely ahead of further mixing or decentralized exchange (DEX) trades.

$2.5 Million in Stablecoins Stolen in Arcadia Hack

According to Cyvers, the stolen tokens included around 2.3 million USDC and 227,000 USDS, totaling a $2.5 million loss across 12 impacted addresses. During the exploit and swap process, the attacker received 199 WETH and approximately 965.8 million AERO tokens.

Cyvers advised blocking the addresses associated with the exploit on both Base and Ethereum, notifying major centralized exchanges and bridge services to monitor and block transactions tied to these addresses, and filing suspicious activity reports with law enforcement to aid in potential recovery efforts.

Arcadia Finance confirmed the exploit on Tuesday via a post on X, stating, “The team is aware of unauthorized transactions via a Rebalancer. Remove all permissions for asset managers. More information will follow.” The platform urged its users to revoke any permissions granted to rebalancers on Arcadia to prevent further risks while the team investigates the breach.

DeFi Exploits Continue to Climb in 2025

The Arcadia Finance incident adds to what has already been a costly year for DeFi platforms. The first half of 2025 has seen over $2.47 billion in losses due to hacks, scams, and protocol exploits, marking a slight increase from the $2.4 billion lost in 2024, according to security data.

However, CertiK noted earlier this month that Q2 2025 saw a 52% decrease in value lost compared to the previous quarter, with losses totaling around $800 million across 144 incidents. 

The Arcadia exploit underscores ongoing vulnerabilities within DeFi systems and the critical need for improved smart contract security and user permission management.