Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·AN8wh5…AJfRSummary
Arcadia V2 is a non-custodial leverage farming and liquidity management protocol operating primarily on Base, developed by Belgium-based Arcadia Finance (founded 2021, backed by Coinbase Ventures). The protocol has suffered two serious security exploits: a July 2023 reentrancy attack on its V1 codebase draining approximately $455K across Ethereum and Optimism, and a more severe July 2025 arbitrary calldata exploit on V2's Rebalancer contract that drained approximately $3.6M on Base despite multiple prior audits. ZachXBT has flagged the protocol as a high-risk entity given this pattern of repeated critical security failures.
Connected Entities
8 entities · 60 linked investigations- Ethereum→mentioned with→Coinbase(60%)
- Across Protocol→mentioned with→Ethereum(70%)
- Across Protocol→mentioned with→Optimism(60%)
- ZachXBT→mentioned with→Ethereum(70%)
- Optimism→mentioned with→Ethereum(80%)
- Optimism→mentioned with→Coinbase(60%)
- Coinbase→mentioned with→Base(70%)
- Coinbase→mentioned with→Optimism(80%)
- Coinbase→mentioned with→ZachXBT(70%)
- Arcadia Finance v1→mentioned with→Arcadia V2(80%)
- + 10 more
Timeline(15 events)
2021
Arcadia Finance founded in Mechelen, Belgium by Jasper Van Pee and Thomas Smets.
10 July 2023
V1 protocol exploited on Ethereum and Optimism via reentrancy attack on liquidateVault() function; approximately $459,030 stolen. PeckShield identifies the attack. Optimism attacker launders ~180 ETH via Tornado Cash.
10 July 2023
Arcadia Finance pauses all contracts, issues on-chain message to attacker demanding return of funds within 24 hours. No funds recovered. TVL drops 76%.
October 2023
Arcadia partners with Trust Security for first V2 security review.
2024
Arcadia V2 audit program begins: Renascence, Pashov Audit Group, and Sherlock contest all review complete V2 codebase in Q1 2024. Pashov internally flags but does not report a vulnerability in SwapLogic._swapViaRouter().
2024
Arcadia V2 targets Q1 2024 launch on Base (announced as goal, not confirmed release date).
April 2024
Sherlock audit contest covers Aerodrome Asset Modules for Arcadia V2 (Q2 2024).
12 March 2025
Arcadia Finance announces public token sale for $AAA on Fjord launchpad.
10 April 2025
AAA Token Generation Event (TGE) completed. AAA reaches all-time high of $1.71 on day of TGE.
June 2025
Arcadia Finance joins the Circle Alliance.
14 July 2025
Attacker funds wallet via Tornado Cash on Ethereum at 10:58 PM UTC; bridges funds to Base approximately 30 minutes later.
15 July 2025
Arcadia V2 Rebalancer contract exploited on Base at 4:03 AM UTC via arbitrary swapData calldata injection. Approximately $3.6M (USDC, USDS, Aerodrome, Slipstream LP NFTs) drained across multiple transactions. CertiK and Cyvers raise initial on-chain alarms.
15 July 2025
Arcadia Finance pauses all contracts, advises users to revoke approvals and disable automations. Offers attacker 10% bounty (~$360K) for 90% fund return within 24 hours. Attacker does not respond.
15 July 2025
AAA token drops approximately 46% in trading following the hack disclosure.
15 July 2025
Stolen funds (approximately 1,203 ETH) bridged from Base to Ethereum via Across Protocol and Relay.
Decision Log
- hash: EEgPAbtVXUwhrYW6z2xrd2CAGc7NCH9wjJzvC9JFbNMR
This investigation is cryptographically anchored to the Solana blockchain (1 event). 21 of 27 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 5/4/2026, 2:54:22 AM
last updated: 8/30/2026, 12:05:00 PM
7 viewsavoid.net — verified advice for a post-truth world