Arkadiko governance attack drains most vault collateral as USDA stablecoin depegs
A malicious contract approved through a governance vote removed about 2 million stSTX and 1.65 sBTC from the Stacks protocol.
SECURITY & HACKS
Lukas Brenner
10/22/20261 min read
Arkadiko, a DeFi protocol on the Stacks blockchain, said on October 22 that a malicious contract had been approved through its governance vote and then used to withdraw most of the collateral held in its vaults. Preliminary figures put the losses at about 2 million stSTX, a liquid stacking token, and 1.65 sBTC, a Bitcoin-backed asset. No final dollar figure has been published.
The protocol's USDA stablecoin lost its dollar peg after the collateral was removed. DeFiLlama data showed total value locked falling from about $1.4 million before the attack to roughly $141,600 on October 23, a drop of about 90%. Arkadiko's total value locked had peaked at about $24.6 million in March 2024.
The team disabled the malicious contract, paused governance and halted vault redemptions and liquidations, leaving stSTX and sBTC vault holders unable to change their positions. It asked exchanges to freeze the stolen assets and is filing a police report. Arkadiko has not explained how the proposal met voting thresholds or whether the attacker acquired voting power.
Source: The Crypto Times.