Arcadia Finance v1
Summary
Arcadia Finance v1 was a decentralized margin lending protocol deployed on Ethereum and Optimism that suffered a critical reentrancy exploit on July 10, 2023, resulting in the loss of approximately $459,030 across both chains. The attack exploited a missing reentrancy guard in the vault liquidation function combined with absent untrusted-input validation, allowing the attacker to bypass collateral health checks and drain darcWETH and darcUSDC vaults. The stolen funds on Optimism were largely laundered through Tornado Cash; the protocol subsequently paused all contracts and issued a bounty ultimatum to the attacker that went unanswered.
Connected Entities
2 entities · 10 linked investigationsTimeline(7 events)
2022-10-01
Nethermind begins audit of complete Arcadia Finance v1 codebase (Q4 2022 – Q1 2023).
Arcadia Finance Audits Documentation2023-07-10
Attacker exploits reentrancy vulnerability in Arcadia Finance v1 vault liquidation function on Ethereum and Optimism. PeckShield issues first public alert. Total losses: $459,030 ($123,758 on Ethereum; $335,271 on Optimism). Attacker addresses: Optimism 0xD3641C912a6A4c30338787E3C464420b561A9467; Ethereum 0x5C75e94dD0Ab9c10BFd1B8073DafEF031D3c050d.
Arcadia Finance Post Mortem / CoinTelegraph2023-07-10
Arcadia Finance team pauses all liquidity pool contracts, sets interest rates to zero, and engages BlockSec, Hexagate, and PeckShield for investigation. TVL falls 77% from $605K to $140K.
Arcadia Finance Post Mortem2023-07-10
Optimism attacker routes approximately 179 ETH through Tornado Cash. Ethereum attacker retains funds in wallet. Team contacts law enforcement and sends on-chain messages to attacker addresses.
Protos / Crypto Daily2023-07-11
Arcadia Finance issues 24-hour on-chain ultimatum: return 90% of stolen funds and keep 10% as white-hat bounty with no legal pursuit, or face a 10% public bounty for information leading to identification and arrest. Attacker does not respond.
DL News / CoinTelegraph2025-07-14
Attacker funds fresh wallet via Tornado Cash on Ethereum at 10:58 PM UTC in preparation for a new exploit targeting Arcadia Finance v2 Rebalancer contract on Base.
Rekt News2025-07-15
Arcadia Finance v2 Rebalancer contract exploited on Base for approximately $2.5M (total later estimated at $3.6M across two attack waves). Attacker bridges 840 ETH to Ethereum mainnet via Across Protocol. AAA token drops 46%. Team offers 10% white-hat bounty; attacker does not comply.
Rekt News / CoinTelegraphDecision Log
- hash: 9R99vYCRzzfsqoZMrUp7psYZYF3dLjCZPZZDyGCm3Kzw
This investigation is cryptographically anchored to the Solana blockchain and source URLs are archived via the Internet Archive.
model: claude-sonnet-4-5
generated: 5/4/2026, 2:54:40 AM
last updated: 5/30/2026, 12:11:45 PM
avoid.net — verified advice for a post-truth world