Arkadiko vault governance attack hack — October 2026

Arkadiko is a lending protocol on Stacks, a network built on top of Bitcoin, where users lock collateral in vaults and borrow its USDA stablecoin. Changes are made by DIKO token votes. According to Bitquery, a stranger’s proposal titled “AIP 32 - Update Vaults Operations for Reward Distribution” went up on 17 October 2026; on 22 October the same wallet bought about 3.39 million DIKO for about $51,000 in STX and voted it through alone, with no votes against. The proposal plugged a contract into Arkadiko’s DAO that let its caller take collateral and print USDA.

Minutes after the vote closed at 16:04 UTC the attacker took all the sBTC and stSTX in the vault pool, printed 1.5 billion USDA and sold a million of it into Arkadiko’s own STX-USDA pool, taking STX that belonged to its liquidity providers. Arkadiko said that evening that a malicious contract had passed through governance and drained most of the vault assets, about 2 million stSTX and 1.65 sBTC on its preliminary estimate, and that USDA had lost its peg. It switched the contract off, paused governance and burned the printed USDA still in the attacker’s wallet. Bitquery puts Arkadiko’s loss at $1.09 million; about 213 ETH went into Tornado Cash. Two days earlier a wallet funded by the same attacker took over StackSwap, another Stacks exchange, the same way.

On 27 October Arkadiko said it had deposited additional collateral so that every vault could be withdrawn, while redemptions stayed paused and USDA traded around $0.30. That is the team covering vault owners, not a recovery from the attacker, so nothing is counted as recovered. The chain is recorded as “other” because the registry has no Stacks value.