An exploiter crafted arbitrary swapData in Arcadia Finance's Rebalancer contract to drain a victim account of ~$3.6M; the attack was funded via Tornado Cash.
On July 15, 2025, Arcadia Finance was exploited when an attacker crafted arbitrary swapData in the Rebalancer contract due to a lack of input validation, draining a victim account of approximately $3.6M across Base and Ethereum. The attack was funded via Tornado Cash. Arcadia offered a 10% bounty for return of funds, but no recovery has been reported.
Exploiter funded attack via Tornado Cash mixer.
N/A