clet.xyz

For approximately $51,000, a single cryptocurrency wallet acquired sufficient DIKO tokens to decisively influence Arkadiko’s governance vote, casting its ballot just 58 minutes before the poll concluded. The proposal faced no opposition and, within minutes of its activation, the attacker had siphoned an estimated $1.09 million from the protocol’s vaults. This incident highlights a critical vulnerability in decentralized autonomous organizations (DAOs), particularly those with low token liquidity and dormant governance participation, where the cost of acquiring control can be significantly less than the assets held within the protocol.

Understanding the Arkadiko Protocol and Decentralized Governance

Arkadiko is a decentralized lending protocol operating on the Stacks blockchain, a layer-2 solution designed to bring smart contracts and decentralized applications to Bitcoin. As a DeFi platform, Arkadiko allows users to collateralize assets like STX (Stacks’ native token) and sBTC (synthetic Bitcoin) to mint USDA, its native stablecoin. The protocol is governed by a DAO, where holders of its native token, DIKO, can propose and vote on changes to the protocol’s parameters, upgrades, and operational contracts. This system is designed to decentralize control and foster community participation, aligning with the core tenets of Web3.

The Stacks ecosystem, while growing, is still relatively nascent compared to larger blockchain networks like Ethereum. This can sometimes translate to lower liquidity for native tokens and smaller, less engaged communities for specific protocols built on it. Governance tokens, such as DIKO, derive their value not only from potential staking rewards or protocol fees but also from the power they grant their holders over the protocol’s future. When the market valuation of these tokens falls significantly, or when governance participation is low, the economic security of the underlying protocol can be jeopardized. The Total Value Locked (TVL) in Arkadiko stood at approximately $1.4 million just before the attack, contrasting sharply with the relatively modest cost to gain governance control.

A Swift and Calculated Takeover: The Attack Chronology

The meticulously planned attack on Arkadiko unfolded over several days, culminating in a rapid execution that exploited the protocol’s governance mechanisms. Bitquery’s on-chain investigation provides a clear timeline of the events:

• October 17, 20:35 UTC: The anonymous attacker initiated Proposal 12, titled "AIP 32 – Update Vaults Operations for Reward Distribution." To meet the submission threshold of 0.25% of DIKO supply, the wallet acquired 193,091 DIKO tokens. This initial acquisition demonstrated the attacker’s intent to gain a foothold in Arkadiko’s governance.
• October 17 – October 22 (Waiting Period): Following the proposal’s submission, a period of apparent inactivity ensued. For almost five days, the proposal remained without votes, a common occurrence in DAOs with passive communities or where proposals are perceived as routine. This dormancy proved critical, as it allowed the attacker to bide their time and avoid early detection.
• October 20 (Parallel Attack): Two days before the Arkadiko exploit, the same wallet operator executed a similar governance attack on StackSwap, another Stacks-based exchange. This preceding attack, which passed with a mere 37,755 votes (0.19% of supply), allowed the attacker to empty 49 StackSwap pools in less than a minute via 51 calls, netting approximately $70,500. This illicit gain was subsequently used to fund the Arkadiko takeover, illustrating a sophisticated multi-protocol exploitation strategy.
• October 22 (The Decisive Hour): The attacker moved with precision and speed.
  • Approximately half an hour before the critical Arkadiko vote, the attacker’s main Ethereum wallet, previously funded through Tornado Cash with 12.2 ETH withdrawn between October 3 and October 22, sent 5.23 ETH to ChangeNOW. This transaction facilitated the rapid acquisition of STX tokens on the Stacks network, which were then used to purchase the necessary DIKO.
  • Around 17:00 UTC, the wallet aggressively bought an additional 4,370,106 DIKO tokens, bringing its total holdings to 4,563,197 DIKO. This acquisition, costing roughly 158,139 STX (approximately $51,000 at the time), gave the attacker overwhelming voting power.
  • Immediately after acquiring the tokens, the wallet cast all its votes in favor of Proposal 12.
  • Within 58 minutes, the proposal successfully passed with a final tally of 4,573,197 DIKO in favor and zero against. This represented 6.7% of the eligible DIKO supply, comfortably exceeding Arkadiko’s 5% quorum requirement (approximately 3.4 million DIKO) by about 1.13 million DIKO.
• Minutes Post-Passage: Immediately after the proposal’s approval, the attacker executed the malicious contract. This allowed for the rapid draining of Arkadiko’s vaults.
• October 22, 18:08 UTC: Arkadiko developers detected the anomaly and swiftly switched off the compromised contract, attempting to stem the outflow of assets.
• October 22, 18:14 UTC: Recognizing the severity of the governance breach, Arkadiko officially paused its governance mechanisms to prevent further exploitation.
• October 22, 19:21 UTC: To mitigate the damage from the printed stablecoin, Arkadiko burned 1.499 billion of the illicitly minted USDA. However, by this point, the underlying collateral that backed the stablecoin had already been removed.

The Anatomy of the Exploit: Malicious Code and Unchecked Functions

The success of the attack hinged on a deceptive proposal that masqueraded as a routine update. Proposal 12 misleadingly claimed to link to GitHub pull request #624, which Bitquery identified as an unrelated, still-open fix from June, submitted by an external account. The true purpose of the proposal was to replace Arkadiko’s legitimate vault operations contract with a malicious one crafted by the attacker, named arkadiko-vaults-operations-v2-1.

This attacker-controlled contract contained two deceptively named functions: set-collateral-tokens and set-debt-tokens. While their names suggested legitimate administrative actions related to managing collateral and debt, their implementation contained a critical flaw: neither function incorporated any caller authentication or permission checks. The only conditions for execution were that the contract was enabled and the specified amount was greater than zero. This complete lack of access control meant that once the proposal passed and the malicious contract was activated, any caller — in this case, the attacker — gained unrestricted control over the protocol’s vaults. This design flaw essentially handed over the keys to Arkadiko’s treasury without any further authorization required.

Financial Devastation: What Left the Vaults

The immediate aftermath of the governance vote saw a rapid and significant drain of assets from Arkadiko’s vaults. The attacker’s malicious contract was executed multiple times to extract various assets.

The stolen funds included:

• 1.5 billion USDA: This was not existing USDA but rather newly minted USDA by the attacker’s contract. The subsequent sale of this massive quantity at approximately $0.13 per token severely broke USDA’s peg, rendering it largely worthless.
• 1,900,100 STX: The native token of the Stacks blockchain.
• 100,000 sBTC: Synthetic Bitcoin, representing a significant portion of the protocol’s high-value collateral.
• 185,000 stSTX: Staked STX, another form of collateral within the protocol.

Bitquery’s analysis, valuing STX at $0.32 and stSTX at 1.18 STX at the time of the attack, calculated the total value of assets drained from Arkadiko at approximately $1.09 million. However, accounting for the actual sale price of stSTX, the total Arkadiko loss is estimated closer to $1.11 million. When combined with the roughly $70,500 stolen from StackSwap in the preceding attack, the attacker’s total illicit gains across both protocols amounted to approximately $1.16 million.

The impact on Arkadiko’s ecosystem was catastrophic. Its Total Value Locked (TVL) plummeted by approximately 90%, from $1.4 million before the attack to a mere $141,600. This stark decline represents not just a financial loss but a profound erosion of trust and functionality, especially when compared to its peak TVL of $24.6 million in March 2024.

The Attacker’s Trail: Following the Money

The on-chain investigation traced the attacker’s activities to a set of anonymous wallets. The primary address responsible for submitting Proposal 12, voting, and subsequently draining the vaults was identified as SP1V1BN459229EJG94YYBJDN50ADVB6MXVVEZ0G34. The attacker’s operational sophistication was evident in their funding strategy. The Ethereum component of their illicit funding was routed through Tornado Cash, a cryptocurrency mixer, with 12.2 ETH withdrawn between October 3 and October 22. This extensive preparation, spanning nearly three weeks before the actual vote, indicates a deliberate and well-researched plot.

After draining the funds, the stolen assets were quickly dispersed through various channels to obscure their origin and facilitate laundering:

• ChangeNOW: Approximately 37% of the stolen STX (around $300,000) was sent to ChangeNOW, a non-custodial instant cryptocurrency exchange.
• MEXC Global: Another 31% of the STX (approximately $250,000) was routed to MEXC Global, a centralized exchange.
• OKX: A smaller portion, about 10% of the STX (roughly $80,000), was sent to OKX, another major cryptocurrency exchange.
• Decentralized Exchanges: The remaining stolen assets, including sBTC and USDA, were converted into STX on decentralized exchanges (DEXs) like StacksSwap and Alex, before being further moved.

Approximately $114,000, corresponding to about 355,500 STX in swap-service payouts, remains untraced, underscoring the challenges in fully recovering stolen funds in the decentralized landscape. It is important to note that while another wallet also took 98,034 STX from StackSwap during the same period, Bitquery found no direct on-chain link between that wallet and the Arkadiko attacker, suggesting either an unrelated incident or a highly sophisticated compartmentalization by the same actor.

Arkadiko’s Response and the Broader Implications for Decentralized Governance

In the immediate aftermath, Arkadiko acknowledged the incident as a "governance attack" via a post on X (formerly Twitter) on the evening of October 22. The protocol team moved to freeze the affected vaults, urged exchanges to freeze any identified stolen funds, and initiated the process of filing a police report. However, the path to recovery for Arkadiko remains fraught with challenges. The protocol’s Security Module, designed to cover shortfalls by selling up to 30% of staked DIKO, itself requires a governance vote to activate. With governance paused due to the attack, the very mechanism intended for recovery is inaccessible, trapping the protocol in a difficult predicament.

This incident serves as a stark reminder of the inherent risks in decentralized governance, particularly for smaller DAOs. While Arkadiko’s governance rules functioned precisely as written — the proposal cleared its submission threshold, reached quorum, and passed with a majority — the failure lay in the broader ecosystem surrounding those rules:

• Lack of Community Engagement: The history of 54 previous proposals originating solely from the team’s wallet fostered a culture of rubber-stamping, where voters were accustomed to approving routine upgrades without critical scrutiny. This inertia allowed an unfamiliar, malicious proposal to slip through undetected.
• Economic Vulnerability: The low market capitalization and liquidity of the DIKO token, coupled with a low quorum threshold, meant that the cost to acquire sufficient voting power ($51,000) was negligible compared to the value of assets held in the vaults ($1.4 million TVL). This economic imbalance created a lucrative target for malicious actors.
• Absence of Robust Security Checks: The protocol lacked additional layers of security, such as timelocks for critical governance actions, multi-signature approvals for contract changes, or a dedicated security committee to vet proposals. These safeguards are crucial in preventing immediate execution of potentially harmful changes.
• Insufficient Scrutiny of Proposals: The community, or a designated security group, failed to adequately review the technical implications of Proposal 12, allowing the attacker’s contract with its unchecked functions to be deployed.

The Arkadiko attack underscores a critical lesson for the entire DeFi sector: for any small DAO whose governance token value and voter engagement are disproportionately low compared to its Total Value Locked, the risk of a hostile governance takeover is not theoretical but a practical and economically viable threat. Protocols must implement more robust governance frameworks, including higher quorum requirements, dynamic voting power models, active community engagement strategies, and stringent security audits for all proposed contract changes. The incident also highlights the continued challenge of tracing and recovering funds in a decentralized, cross-chain environment, especially when mixers like Tornado Cash are utilized by attackers. The long-term viability of decentralized finance hinges on the ability of DAOs to secure their governance mechanisms against such calculated and economically motivated exploits.