Arkadiko estimates that about 2 million stSTX and 1.65 sBTC were taken from its vaults. Affected users cannot adjust positions as the team pursues recovery.
Arkadiko, a DeFi protocol on Stacks, said an attacker drained most of its vault collateral on October 22 after a malicious smart contract passed a governance vote. In its six-post account of the incident, the team estimated that about 2 million stSTX and 1.65 sBTC were taken. USDA subsequently lost its dollar peg. The token amounts are preliminary; Arkadiko has not released a final dollar loss figure.
The team published the disclosure at 20:29 UTC on October 22 and said the attack had happened earlier that day. It disabled the malicious contract and temporarily paused governance, vault redemptions and liquidations. Arkadiko has not yet shared the attack transactions or explained how the attacker obtained voting power.
Arkadiko’s October 22 disclosure of the attack
The post loads from X when you open it.
Which users and functions are affected?
Users with open stSTX or sBTC vaults cannot modify their positions because the affected collateral is no longer available, according to the team. USDA holders and liquidity providers on Arkadiko’s decentralized exchange have also been affected by the depeg. Arkadiko says its DEX and other STX vault functions remain available.
| Asset or function | Reported status |
|---|---|
| stSTX collateral | About 2 million tokens taken; affected vaults cannot be modified. |
| sBTC collateral | About 1.65 tokens taken; affected vaults cannot be modified. |
| Governance | Temporarily paused. |
| Redemptions and liquidations | Temporarily paused. |
| DEX and other STX vault functions | Available, according to the team. |
The two collateral tokens represent different assets. Stacking DAO describes stSTX as a transferable token issued against deposited STX, with compounded STX rewards increasing its value relative to STX. Stacks describes sBTC as a programmable asset backed 1:1 by Bitcoin. Arkadiko reported the theft of tokens held in its vaults; it did not report an attack on the Bitcoin network or on the entire reserves backing either token.
How the lost collateral affects USDA
Under Arkadiko’s vault model, users lock up crypto assets worth more than the USDA they mint. They can obtain USDA without selling the collateral. In normal operation, one USDA can be redeemed for $1 worth of vault collateral, less a redemption fee. Traders exploiting a price difference through redemptions help support the peg. With the collateral missing and redemptions paused, USDA holders cannot make the normal exchange for vault assets.
DeFiLlama’s daily Arkadiko table shows about $1.43 million in total value locked on October 22 and $141,585 on October 23. Using the rounded starting value, the drop is approximately 90.1%. The page’s current headline figure, read at about 14:15 UTC on October 23, was $137,503. That live reading is separate from the $141,585 daily UTC snapshot. The historical TVL peak was $24.59 million on March 24, 2024.
TVL is not a final loss calculation. DeFiLlama measures the total value of tokens held in protocol contracts. A change in that dollar value is a different measure from the quantities reported stolen. Arkadiko has not published final dollar losses or losses per user, and it has not guaranteed that USDA will regain its $1 peg.
A June 24, 2024 presentation on the official Stacks channel explains vault collateral and USDA minting between 0:58 and 1:50. The recording predates the attack by more than two years; the speaker describes sBTC support as a future addition at that time. The product and yield information dates from 2024; it does not describe the functions paused today or the safety of funds after the attack.
How did the malicious contract pass a vote?
Arkadiko has confirmed that the contract passed governance but has not published the attacker’s proposal or the voting breakdown. Its governance documentation requires an on-chain vote for smart contract upgrades. An address must hold 0.25% of circulating DIKO to create a proposal. Votes representing at least 5% of circulating supply are needed for quorum, and more than 50% of votes cast must be in favor for a proposal to pass.
Under the documented process, contributors identify an issue, discuss it with the community on Discord and prepare an Arkadiko Improvement Proposal. A DAO member then puts the proposed contract changes on-chain. Voting follows, and an approved change becomes part of the protocol. It has not been verified whether the attacker bought votes, borrowed voting tokens or exploited a particular code vulnerability. The voting thresholds do not reveal which method was used.
What is known about recovering the funds?
Arkadiko said it had asked relevant crypto exchanges to freeze stolen funds and was filing a police report. The team said its priorities were securing the protocol and recovering user funds, with updates to follow as information is verified. Arkadiko has not confirmed that exchanges froze funds, reported a recovered amount or set a repayment schedule.
“We are deeply sorry to everyone affected.”
The protocol’s Security Module rules allow up to 30% of the DIKO staked in the module to be sold to cover bad debt caused by a hack or exploit. DIKO holders must approve the sale through governance, and stakers risk losing up to 30% of the tokens they have committed. Arkadiko has not announced plans to use the module for this incident, while governance remains paused. Using the module would require a separate decision; the team has not promised that a sale would cover the entire shortfall.
On October 28, 2021, Arkadiko disclosed a separate vulnerability in its Swap contract. An attacker took 400,000 STX and an equivalent amount of USDA, about 12% of the STX–USDA pool. The team said it secured the remaining assets, representing more than 88% of the total pool, and that vaults and the staking module were unaffected. The funds secured in 2021 belonged to that Swap pool; the team has not announced any recovery of the vault collateral taken in 2026.
