Arcadia Finance hack — July 2025

Arcadia Finance, an on-chain margin protocol on Base, was drained on 15 July 2025 through its Rebalancer contract.

Arcadia let users delegate rebalancing of their margin accounts to an asset manager contract. The RebalancerSpot contract passed a user-supplied swapData parameter, including the address of the router that would execute the swap, straight through the call chain RebalancerSpot.rebalance() to AccountV1.flashAction() to actionTarget.executeAction() without validating it. CertiK noted that nowhere in that call chain are the actionTarget and router addresses decoded from swapData ever examined. SolidityScan classified the flaw under OWASP SC06:2025 Unchecked External Calls. By registering their own malicious contract as both the router and a whitelisted Arcadia account, the attacker spoofed a privileged execution context and pulled assets out of any account that had granted the Rebalancer asset-manager permissions, bypassing health checks by repaying debt first.

The figures were reported in stages and still differ. The Defiant and SolidityScan both give the loss as approximately $3.5 million, converted into roughly 840 ETH. CertiK's own write-up puts it at approximately $3.6 million, or 1,203 ETH swapped through 1inch. The two ETH figures are not reconcilable with a single USD total at July 2025 prices, and no party has published a reconciliation. Stolen USDC and USDS were swapped to wrapped ether on Base and the proceeds bridged to Ethereum mainnet.

Arcadia paused the affected contracts and told users to revoke all asset manager permissions. No public post-mortem was released. The stolen funds were not recovered and no arrests have been reported. Some users held third-party cover: Nexus Mutual, through the Base-based coverage seller OpenCover, paid roughly $250,000 in claims, with filing opening on 29 July after a 14-day cooldown — a small fraction of the loss.