Hackers clean $2.5M from Arcadia Finance exploit

Earlier today, July 15, Arcadia Finance, a liquidity management platform for decentralized crypto exchanges, was exploited, resulting in a loss of about $2.5 million in crypto assets. The hackers targeted one of the platform’s key features, the rebalancer on the Base network. 

Shortly after the exploit, the Arcadia team took to X, formerly Twitter, to warn users, urging them to remove the permissions for their asset managers and remove active rebalancers to prevent further losses.

More about the hack

According to blockchain security firm PeckShield, Arcadia Finance lost about 840 Ethereum tokens, worth roughly $2.5 million at current prices. PeckShield wrote in an X post that the hackers have already bridged the stolen assets from Base to Ethereum, and the sanctioned crypto mixer, Tornado Cash, reportedly played a part.

While the value of ETH lost to the hackers is considerable, it is not the first time Arcadia has experienced such an occurrence. The liquidity management platform witnessed a $455,000 hack in July 2023 when hackers exploited a vulnerability in its code.

Arcadia Finance is backed by Coinbase Ventures and is also part of the Circle Alliance, which it joined in late June. According to its website, USDC makes up more than a third of Arcadia’s TVL.

Arcadia’s contracts have now been paused with no clear timeline for contract resumption. In the meantime, it reports that it is collaborating with security analysts in a bid to ascertain how the breach occurred.

Arcadia Finance said, “We will continue to work with our security partners, law enforcement, and the broader community to resolve this as best we can. Our number one priority is recovering funds for Arcadia protocol users.”

As for how the community and market are reacting to the exploit, skepticism and concern have taken center stage, with many worried about the state of cross-chain security.

Wave of hacks sweeps through crypto in 2025

Over $2.1 billion has been stolen across more than 75 hacking incidents so far this year, a figure that nearly accounts for the total losses recorded in 2024.

This indicates a significant increase in attacks, and they differ in scale and sophistication compared to years 2024 and earlier. The amount the hackers got away with in the Arcadia exploit is small compared to the larger hacks that have happened this year; however, it calls attention to the vulnerabilities that plague the DeFi sector.

One recurring problem is that smart contracts and cross-chain mechanisms, especially bridges, are still too susceptible to attacks, and criminals know it.

According to reports, more than 80% of the stolen funds in 2025 happened in infrastructure-level breaches that saw the hackers get away with more funds than other exploit types, like smart contract vulnerabilities.

The most notable hack this year has been the breach of the Bybit exchange that occurred in February, where hackers made away with $1.5 billion. The attack, attributed to North Korea-linked Lazarus Group pushed the average hack size to double what it was in 2024.

Other notable incidents have included the $225.6 million Cetus protocol exploit and the $89.1 million hack of the Nobitex exchange in Iran, actions linked to the Israel-based group Gonjeshke Darande.