A major security breach has shaken decentralized finance once again, this time hitting Arcadia Finance, a protocol operating on Coinbase’s Base network.
Nearly $3.5 million was drained in a series of suspicious transactions, drawing renewed attention to the growing risks associated with DeFi infrastructure.
The incident began with unusual activity on the Ethereum Layer-2 network, first flagged by blockchain security firm Certik. Analysts identified unauthorized interactions with Arcadia’s Rebalancer contract—an internal mechanism designed to help balance user portfolios. Within hours, the attack escalated, and the stolen funds climbed to over $3 million.
Arcadia Finance confirmed the exploit via a post on X (formerly Twitter), urging users to immediately revoke permissions for the compromised components, specifically the Rebalancer and Compounder modules. The platform also updated its website with warnings, advising users to disconnect from the affected contracts.
Backed by Coinbase Ventures, Arcadia has marketed itself as a permissionless platform for borrowing, lending, and swapping assets. However, this exploit highlights the persistent vulnerabilities even among well-supported DeFi players.
Certik, which monitors the Web3 security landscape, recently reported that losses across the DeFi space topped $302 million in May alone, although that marked a slight decline from the previous month. The firm—supported by investors like Sequoia, Goldman Sachs, and Tiger Global—continues to stress the need for smarter risk controls in the sector.
As investigations continue, the Arcadia breach adds another entry to the mounting list of DeFi attacks, reinforcing concerns about how exposed these decentralized protocols remain to sophisticated exploits.
Source: https://coindoo.com/base-based-defi-platform-suffers-3-5-million-hack/