Arkadiko Governance Attack — Post-Mortem and Recovery Update

On October 22, 2026, Arkadiko suffered a governance attack that resulted in the theft of user collateral and the depegging of USDA. The attacker exploited Arkadiko’s governance mechanism to authorize a malicious smart contract with privileged access to the protocol’s vaults. How the attack happened On October 17, the attacker deployed a malicious vault operations contract and submitted Governance Proposal #12 (AIP-32) . On October 22, the proposal received approximately 4.57 million DIKO votes in favor, with zero against , allowing it to pass governance . The malicious contract was then used to: Withdraw 2,065,481.479441 stSTX from the vault pool. Withdraw 1.65221692 sBTC from the vault pool. Mint 1,500,354,999 unbacked USDA , severely disrupting USDA’s peg. This figure represents tokens minted, not their realized USD value. The total amount of unbacked USDA was minted across six transactions , including two large mints of 999,999,999 USDA and 500,000,000 USDA , followed by four smaller mints of 200,000 USDA , 100,000 USDA , 30,000 USDA , and 25,000 USDA . The stolen assets were initially transferred to the following address: SP1JB85VZ7TX7SWSNW0PHV115YPQE5QXJDG6P60AQ The attacker subsequently converted the collateral into STX and distributed the proceeds across multiple wallets, including cross-chain routes to Bitcoin and Ethereum. Immediate response Following the attack, we took the following steps to prevent further damage: Disabled the malicious contract . Paused governance . Paused vault redemptions and liquidations . Collateral restoration and protocol operations Following the attack, we used Arkadiko treasury funds to purchase replacement stSTX and sBTC and replenish the affected vault contracts , restoring the required collateral balances. This has allowed users to resume vault activity, including repaying existing USDA debt and minting new USDA. Redemptions and liquidations remain paused to protect the integrity of user collateral. USDA has not yet returned to its peg. We have also swapped STX collateral from our treasury to burn the majority of unbacked USDA: Burned USDA: 1. Burn USDA TX one 2. Burn USDA TX two The replenishment was funded by Arkadiko’s treasury and is separate from our ongoing efforts to recover the stolen assets. On-chain transaction history of the attacker For transparency, below is the transaction history of the main receiving wallet following the attack. Attacker wallet: SP1JB85VZ7TX7SWSNW0PHV115YPQE5QXJDG6P60AQ The following 21 transactions occurred on October 22, 2026. Times are UTC. This ledger covers activity initiated by the wallet, as verified through October 23, and does not include transactions initiated by downstream wallets or any subsequent activity. 1. Conversion of stolen collateral The attacker sold the entire 2,065,481.479441 stSTX withdrawn from Arkadiko vaults across five swaps, receiving 2,276,728.353737 STX . 16:18:41 –871,602.110960 stSTX → 1,030,628.447505 STX. Transaction 16:23:09 –103,879.368481 stSTX → 121,454.758557 STX. Transaction 16:59:19 –272,500 stSTX → 321,474.632824 STX. Transaction 17:15:24 –400,000 stSTX → 394,686.153038 STX. Transaction 17:16:13 –417,500 stSTX → 408,484.361813 STX. Transaction 2. Additional swaps The main wallet also executed the following swaps: 16:28:08 –1,000,000 USDA → 514,425.088747 STX. Transaction 17:42:51 –0.10248167 xBTC → 17,721.319253 USDA. Transaction 17:42:51 –8,000 USDA → 535.100367 STX. Transaction 3. Outgoing transfers The attacker distributed the proceeds across several wallets. The primary collector address was: SPR3KWTVF3ZKPW256Y6233WFJVHHMX92PQ0FSCY1 Transfers from the main wallet: 16:31:13 –1.65221692 sBTC → collector. Transaction 16:31:13 –1,000 STX → collector. Transaction 16:41:32 –10,000 STX → SP34J660…C4T7A. Transaction 16:42:31 –10,000 STX → collector. Transaction 16:43:24 –1,640,000.176848 STX → collector. Transaction 17:12:47 –20,000 STX → SPCR3KXA…7V3V. Transaction 17:17:44 –513,576.136875 STX → SP26KHWD…KJ18W. Transaction 17:18:53 –599,000.999700 STX → collector. Transaction 17:47:55 –40,700.440267 STX → collector. Transaction Total direct STX transfers: 2,834,277.753690 STX , distributed as follows: Collector SPR3…SCY1: 2,290,701.616815 STX SP26KHWD…KJ18W: 513,576.136875 STX SPCR3KXA…7V3V: 20,000 STX SP34J660…C4T7A: 10,000 STX Additionally, 1.65221692 sBTC was sent directly to the collector. 4. Failed transactions The same wallet initiated four unsuccessful transactions: 17:08:16  — Failed Stacking DAO withdraw-idle call. Transaction 17:09:17  — Failed Stacking DAO withdraw-idle call. Transaction 17:10:16  — Failed Stacking DAO withdraw-idle call. Transaction 17:41:39  — Failed Arkadiko swap. Transaction These transactions reverted and did not complete their intended operations. Cross-chain transfers: USDCx to Ethereum Further tracing identified 14 successful USDCx bridge withdrawals from Stacks to Ethereum , involving two downstream wallets linked to the attack through on-chain transfers. A total of 305,348.868742 USDCx was burned on Stacks, resulting in 305,320.868742 USDC credited to Ethereum addresses after 28 USDC in bridge fees. These transactions are separate from the 21 transactions initiated by the main attacker wallet listed above. 5. Collector wallet — 12 bridge transactions Stacks source: SPR3KWTVF3ZKPW256Y6233WFJVHHMX92PQ0FSCY1 Ethereum destination: 0x9a868f1db69d609a8efe14d979c53ebddd2a3875 The collector wallet initiated twelve withdrawals totaling 244,618.208280 USDCx . All times are UTC. Each entry links to the USDCx burn on Stacks and the corresponding USDC settlement on Ethereum. 18:03:00 –10,000.385446 USDCx → 9,998.385446 USDC. Stacks · Ethereum 18:28:07 –29,734 USDCx → 29,732 USDC. Stacks · Ethereum 19:06:50 –22,535.878082 USDCx → 22,533.878082 USDC. Stacks · Ethereum 19:09:42 –19,731.441425 USDCx → 19,729.441425 USDC. Stacks · Ethereum 19:43:31 –15,000 USDCx → 14,998 USDC. Stacks · Ethereum 19:45:51 –22,418.891101 USDCx → 22,416.891101 USDC. Stacks · Ethereum 19:47:58 –15,190.389815 USDCx → 15,188.389815 USDC. Stacks · Ethereum 19:48:22 –20,000 USDCx → 19,998 USDC. Stacks · Ethereum 19:52:53 –41,280.471633 USDCx → 41,278.471633 USDC. Stacks · Ethereum 20:34:09 –12,879.510409 USDCx → 12,877.510409 USDC. Stacks · Ethereum 23:26:31 –19,833.537614 USDCx → 19,831.537614 USDC. Stacks · Ethereum 23:54:56 –16,013.702755 USDCx → 16,011.702755 USDC. Stacks · Ethereum 6. Secondary wallet — 2 bridge transactions Stacks source: SP26KHWDJ2YS68FVH3NZP12Y9H3RZN3SC1R6KJ18W This wallet previously received 513,576.136875 STX directly from the main attacker wallet. Ethereum destination: 0x425679fa1ab564815df9cbd91be68fc27c644073 Two further withdrawals totaling 60,730.660462 USDCx were identified: 19:54:07 –28,523.796245 USDCx → 28,521.796245 USDC. Stacks · Ethereum 20:07:35 –32,206.864217 USDCx → 32,204.864217 USDC. Stacks · Ethereum 7. Ethereum continuation The received USDC was subsequently swapped into ETH. Across nine identified Ethereum swaps, the two destination wallets converted 305,320.868742 USDC into approximately 127.671657 ETH . Funds were subsequently consolidated through additional Ethereum transactions, including transfers to: 0xe8CBDC3bB8e7Af91F0B7Aa91696c5624b4d05006 This downstream wallet made nine deposits totaling 213.3 ETH into Tornado Cash pools on October 23. However, the relevant Ethereum wallets also received funds from other sources. The full 213.3 ETH cannot be attributed exclusively to the Arkadiko attack. Likewise, the STX swaps, bridge withdrawals and Ethereum transfers represent successive movements or conversions of assets. They should not be added together as separate losses. Recovery efforts and next steps We are working with legal counsel and relevant exchanges to trace and pursue recovery of the stolen funds. While the immediate collateral shortfall has been addressed using treasury funds, our investigation and recovery efforts remain ongoing. Governance and redemptions remain paused. We deeply regret the impact on our users and remain committed to protecting their assets, restoring normal protocol operations, and improving governance security. Further updates will be published as information becomes available. Disclaimer: This post reflects our current understanding of the incident based on available on-chain evidence and our ongoing investigation. Despite our efforts to ensure accuracy, certain details may be incomplete or inaccurate. We may update this post periodically to correct inaccuracies, clarify findings, or incorporate newly verified information.