Threatened hacker who stole 140 million lira: 'Return it or we will hunt you down'

Arcadia delivered a clear warning directly to the attacker's wallet via an on-chain message: "Return 90% of the stolen funds within 24 hours, and keep the remaining 10%. Otherwise, we will take all legal steps to find you and offer a reward for anyone who identifies you." The message, sent at 11:36 a.m. on Tuesday, stated that legal proceedings would be dropped if the majority of the funds were returned, but otherwise, a 10% reward fund would be launched to reveal the attacker's identity.

140 MILLION LIRA STEAL

The attack stemmed from an arbitrary call vulnerability in Arcadia's code. This vulnerability allowed the hacker to withdraw large amounts of assets from the system without authorization. In a series of transactions lasting hours, a total of $3.5 million (approximately 140 million lira) was removed from the protocol.

Following the incident, Arcadia issued a warning to its users on social media platform X, urging them to revoke the permissions they had granted to smart contracts. It was also reported that the platform had over $21 million in user funds prior to the attack.

Arcadia's native token, AAA, has lost 46% of its value following the attack. The token is currently trading at around $0.18.

NOT NEW TO THE CRYPTO WORLD

Arbitrary call vulnerabilities aren't new to the crypto world. In January, Odos Protocol lost $50,000 due to the same vulnerability. In 2023, CoW Swap suffered a $180,000 loss due to a similar vulnerability.

Arcadia's strategy is a tactic occasionally used in the DeFi world. Protocols can choose to reclaim most of the stolen funds in exchange for the attacker promising to waive legal proceedings. Last week, GMX recovered $40 million from the hacker using this method.

But not everyone follows suit. Coinbase, an investor in Arcadia, offered a reward of the same amount for anyone who caught the attackers in May, rather than complying with a $20 million ransom demand.

According to data from DefiLlama, 2025 could be the worst year yet for the crypto world. The total amount of crypto assets stolen since the beginning of the year has surpassed $2 billion.