A hacker exploited a code vulnerability on Arcadia Finance, a noncustodial DeFi (decentralized finance) protocol to drain almost $455,000 of its funds.
The funds were drained from Arcadia’s Optimism and Ethereum vaults.
Starting from the Q2 (second quarter) of this year, scams and hacks within the cryptocurrency sector have brought an overall figure loss of more than $300 million cumulative.
A report from CertiK, a blockchain security firm revealed that a total of 212 security breaches were recorded within this quarter.
These incidents summarized into a loss on the Web3 protocols that amounts to $313,566,528.
Comparing the 2023 second quarter with the 2022 second quarter, CertiK discovered that hacks on cryptocurrency have reduced by 58%.
Of all the hacks perpetrated, BNB Smart Chain experienced the majority of the hacks with 119 hacks which led to a loss of $70,711,385.
More Details of the Hack
According to PerkShield, a blockchain investigator alert, Arcadia Finance has experienced a hack due to “non-trustworthy input validation.”
Supposedly, the code which the noncustodial DeFi protocol uses doesn’t have a validation mechanism that can cross-check any unverified input.
As a result of this code vulnerability, the exploiter was able to siphon funds around the tune of almost $455,000 from Optimism (darcUSDC) and Ethereum (darcWETH) vaults.
The majority of the drained funds came from Optimism with the approximation of 180 Ethereum (ETH) which has been washed through Tornado Cash.
READ ALSO:Regulators Order Crypto Exchanges To Get license Or Bear Enforcement Actions
Despite that, the drained tokens on Ether are more than $103,000 at present and they are still stored at the suspect’s wallet address.
How Is Arcadia Finance Handling the Issue?
After receiving the alert of the scam from the blockchain investigator PerkShield, Arcadia confirmed the hack 2 hours later through a Twitter post.
Following that, the protocol suspended its ongoing contracts to stop more draining of funds.
They further declared through a tweet that, the protocol will investigate thoroughly with security experts until it reaches to the root cause of the security bridge.
However, the protocol still has another weakness in its code which exploiters can take advantage of to cause mayhem in the company funds.
As per PeckShield’s analysis, there is still a vulnerability concerning non-reentrancy protection.
This state of affairs “enables immediate liquidation to overcome the internal health check.”
