DeFi Platform Arcadia Finance Hacked for $455K

Another day, another DeFi hack. Arcadia Finance has reportedly been the victim of an exploit which allowed hackers to drain roughly $455,000.

Decentralised finance (DeFi) platform Arcadia Finance has reportedly become the latest victim of a hack. Blockchain investigating firm PeckShields reported the exploit and said it was due to “the lack of untrusted input validation.” 

#PeckShieldAlert Our community contributor has detected that @ArcadiaFi has been exploited on both #Ethereum and #Optimism for ~$455KThe exploiter on #Ethereum was frontrun by 0x5C75e94dD0Ab9c10BFd1B8073DafEF031D3c050dhttps://t.co/blGx5IEAkkThe exploiter on #optimism… pic.twitter.com/WDzF0XVcmL

— PeckShieldAlert (@PeckShieldAlert) July 10, 2023

PeckShields alerted about a code vulnerability that allowed a hacker to drain funds worth about $455,000 from Ethereum (darcWETH) and Optimism (darcUSDC) vaults. According to the firm, the code vulnerability lacked a validation mechanism to cross-check unverified inputs. It added, “There is a lack of reentrancy protection, which allows for the instant liquidation to bypass the internal vault health check.”

PeckShields also reported the exploiter transferred roughly 179 ETH by bridging 148 ETH and swapping 59,000 USDC to crypto mixer Tornado Cash.

Arcadia TVL Drops 76%

Following the hack, DeFiLlama reported that Arcadia’s Total Value Locked (TVL) dropped by a staggering 76%, from $605,000 to $145,000.

The exploit on Arcadia Finance comes only days after a $130 million hack on Multichain’s MPC bridge platform.

Observers noted $102 million worth of crypto was withdrawn from the Multichain Fantom bridge on the Ethereum side. $666,000 worth of Dogecoin (DOGE) and $5 million from Moonriver were also removed. An additional 7214 Wrapped Ether tokens, 1024 Wrapped Bitcoin, and $58 million worth of USDC tokens were drained from the Fantom bridge’s Ethereum smart contract.

Arcadia Acknowledges Exploit

Arcadia Finance acknowledged the exploit on their protocol but has yet to provide further information.

The platform informed its users this morning that it had contacted the hacker.

We have initiated contact with the attacker. https://t.co/dh74gG90n6 https://t.co/O39Slsc1z5We will continue to work with our security partners, law enforcement, and the broader community to resolve this as best we can. Our number one priority is recovering funds for Arcadia…

— Arcadia Finance (@ArcadiaFi) July 10, 2023

Disclaimer: This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.