blockintAI · Research blog

Arkadiko Governance Attack: A Fake Upgrade Drained 2.07M stSTX and 1.65 sBTC on Stacks, Two Days After the Same Wallets Hit StackSwap

BlockintAI · 2026-10-25T12:31:18.754Z

On October 22, 2026, a malicious contract passed Arkadiko governance as proposal #12 and was used minutes later to drain Arkadiko's vaults on Stacks, the Bitcoin layer 2. On-chain, 2,065,481.48 stSTX and 1.65221692 sBTC left the vault pool and 1,500,354,999 unbacked USDA, Arkadiko's stablecoin, were minted.

Arkadiko confirmed the governance attack that afternoon, estimated the loss at about 2 million stSTX and 1.65 sBTC, and said USDA had lost its peg. We followed the attack and the money on public blockchain data, and found that the same wallets ran a similar fake upgrade against StackSwap, another Stacks DEX, two days earlier.

Times are in US Central Time (CT), with UTC in brackets where it matters.

Key facts
Date Oct 22, 2026; proposal executed 11:04 AM CT (16:04 UTC)
Taken 2,065,481.48 stSTX and 1.65221692 sBTC from the vault pool, plus 1,500,354,999 USDA minted
Method A contract posing as a routine upgrade ("AIP 32") was registered through governance; two of its functions had no caller check
Vote One vote, 4,573,197.39 DIKO, cast by the attacker
Earlier target StackSwap, Oct 18–20: fake "Swap V6 Upgrade" proposal, 51 migrate calls moved pool assets to the attacker's wallet
Cash-out 38 one-time deposit-style Stacks addresses; 4.86 BTC withdrawn via sBTC; 305,348.87 USDCx bridged to Ethereum; 213.3 ETH into Tornado Cash
Project status (Oct 25) Arkadiko added collateral to the vaults; vault withdrawals and debt repayment resumed, redemptions still paused, USDA around $0.30
BlockintAI report Arkadiko governance attack on Stacks

How the attack worked

The fake upgrade

On October 17 at 3:10 PM CT, the Stacks address SP1V1BN459229EJG94YYBJDN50ADVB6MXVVEZ0G34 deployed a contract named arkadiko-vaults-operations-v2-1 (transaction). Twenty-five minutes later it put that contract up for a vote as "AIP 32 - Update Vaults Operations for Reward Distribution" (proposal), asking governance to register it as Arkadiko's vaults-operations contract, with the right to mint USDA.

The name sounded routine. The published source code was not. Two functions had no check on who was calling them:

  • claim-pending-yield sent any amount of any collateral token from the vault pool to any address.
  • settle-fee-budget minted any amount of USDA to any address.

One vote was enough

Proposal #12 needed DIKO, Arkadiko's governance token, behind it. The attacker collected 4,573,197.39 DIKO:

  • 193,090.72 from SP1JB85VZ7TX7SWSNW0PHV115YPQE5QXJDG6P60AQ on Oct 17,
  • 83,473.60 from SPR3KWTVF3ZKPW256Y6233WFJVHHMX92PQ0FSCY1 on Oct 20 (the same amount that wallet had just pulled out of StackSwap, below),
  • 905,443.91 from SP2RG9V7GJ9PMRQJTBFZY17FNSX0MQYFHTEGT0VB1 at 9:16 AM CT on Oct 22,
  • 3,391,100.49 bought on Arkadiko's own DEX for 145,918.18 STX at 10:03 AM CT,
  • 88.66 from a 1 STX test swap at 10:02 AM CT.

At 10:06 AM CT it cast all of it for #12 (vote). It was the only vote recorded on the proposal. At 11:04 AM CT the same address executed it (execution).

The drain

Within minutes the attacker called the new contract in separate transactions, each paying SP1JB85VZ7TX7SWSNW0PHV115YPQE5QXJDG6P60AQ:

  • 11:06 AM CT: 1.65221692 sBTC from the vault pool (transaction).
  • 11:09 AM CT: 2,065,481.48 stSTX (transaction) and a mint of 999,999,999 USDA (transaction).
  • 11:26 AM CT: another 500,000,000 USDA (transaction), plus 355,000 USDA in four smaller mints paid to the proposer, SP1V1BN....

About 1.36 million USDA was sold on Arkadiko's DEX for STX and xBTC, and the stSTX was swapped for STX in Stacks DEX pools. USDA lost its peg.

At 1:08 PM CT an account holding Arkadiko admin rights switched on the malicious contract's shutdown and paused governance. At 2:21 PM CT it burned the 1,499,009,720.32 USDA still sitting in the attacker's wallet (transaction).

The same playbook on StackSwap, two days earlier

Our on-chain review found that the wallet that later held most of the Arkadiko proceeds had already used the same trick on StackSwap:

  • Oct 18, 3:47 AM CT: SPR3KWTVF3ZKPW256Y6233WFJVHHMX92PQ0FSCY1 sent 5,000 STX to a new address, SP1BPT084EN10WTVGYNGF9J2ZF1F2CZJJGNH0NDAG.
  • 3:53 AM CT: that address deployed stackswap-swap-v6a (transaction), whose source hard-codes its own deployer as the "migration operator".
  • 4:08 AM CT: it filed StackSwap governance proposal #4, "Swap V6 Upgrade - Dynamic Fee Tiers" (transaction), to register the contract.
  • Oct 20, 10:12–10:13 AM CT: it executed the proposal and made 51 migrate calls (first one) that moved StackSwap pool assets to SPR3KWTVF3....

Those assets included 32,448.01 STX, 24,147.19 USDA, 6.34513203 LBTC, 829,879.41 STSW, 25,071,894.04 WELSH, 956,685.44 MIA v2, 2,882,133 MIA v1, 271,445.92 NYC and 83,473.60 DIKO. At 11:15 AM CT the same day, SPR3KWTVF3... passed that DIKO to the Arkadiko proposer, and it was later cast in the vote. Between 11:40 and 11:42 AM CT, it also sent all of the STSW, LBTC, MIA and NYC on to SP1JB85..., the wallet that received the Arkadiko drain two days later.

Both attacks used the same pattern: a fresh contract with an ordinary-sounding upgrade name, a governance proposal, enough voting tokens to pass it alone, and code that let the attacker move the pooled assets once it passed.

Where the money went

Out of Stacks through 38 one-time addresses

From SP1JB85..., 2,290,701.62 STX and the 1.65 sBTC went to SPR3KWTVF3ZKPW256Y6233WFJVHHMX92PQ0FSCY1 between 11:31 AM and 12:47 PM CT, and 513,576.14 STX went to SP26KHWDJ2YS68FVH3NZP12Y9H3RZN3SC1R6KJ18W. From these two and a few wallets they funded, 1,001,011.64 STX went to 38 one-time addresses between 12:12 and 2:29 PM CT, 2,000 to 50,000 STX each.

Every one of them forwarded the full amount within minutes to one of two high-volume wallets: 26 to SP19YH...T3NY (657,260 STX) and 12 to SP2TA4...KSDD (343,751.64 STX, all with the same memo, 103539619). Both may be service or exchange wallets, with over 11,000 and 235,000 transactions respectively. That pattern, a new address that receives once and empties into a busy wallet, is what exchange deposit addresses look like.

SP19YH...T3NY also paid STX to the attacker's wallets before the attack: 1,936.42 and 321.98 STX to SP1JB85... on Oct 17, about 30,600 STX to the StackSwap proposer on Oct 18–19, and 39,298.59 STX to SP2RG9V7... between 9:38 and 10:12 AM CT on Oct 22, around the time of the vote. Those look like withdrawals from the same platform, which makes it a useful place for investigators to ask.

To Bitcoin through sBTC

SPR3KWTVF3... bought more sBTC with STX and then asked the sBTC bridge to pay out on Bitcoin. Four withdrawals, 4.85824088 BTC in all, reached bc1q8hgk37ejgss57qthjq2l33vten46yg3wxsj08s between 7:14 and 8:59 PM CT on Oct 22. At 10:05 PM CT it was consolidated into bc1q09hhndrn9aj5jqn508jq0tmcaz4vkvleum4qle (transaction).

On the morning of Oct 23 that address split the BTC across seven new addresses. Six of them (0.68 to 0.86 BTC each) forwarded nearly everything the same day in transactions carrying the same OP_RETURN tag format, a layout that matches cross-chain swap or bridge deposits. The seventh, bc1qrtv4rajuep2yldxwdwq6qzzd0wh85wt3ncj2qg, still held 0.05 BTC as of the morning of October 25.

To Ethereum, and into Tornado Cash

SPR3KWTVF3... and SP26KHWD... swapped STX for USDCx and burned 305,348.87 USDCx in 14 bridge transfers to Ethereum between 1:03 and 6:54 PM CT on Oct 22. On Ethereum, 305,320.87 USDC was minted to two addresses (the 28 USDC difference matches bridge fees):

Three more wallets, funded that afternoon mostly by swap services, also sent ETH to 0x9a86...: 0x98a7b251273300fd5be97f7301c147de8ee60ae8 (24.16 ETH), 0x2a0f124d9efcd06c2b0bcab0652778702e9ffa84 (9.28 ETH) and 0xdb820cc64e78650d9ffe38b63a505ca213c5fa9a (16.00 ETH). The last one had taken ten 0.1 ETH withdrawals from Tornado Cash on Oct 2.

At 9:52 PM CT, 0x9a86... sent 213.26 ETH to 0xe8cbdc3bb8e7af91f0b7aa91696c5624b4d05006 (transaction). Between 11:05 and 11:11 PM CT that wallet made nine deposits, 213.3 ETH in all, into Tornado Cash through the Etherscan-labeled Tornado.Cash: Router (first deposit).

0x9a86... had also received Tornado Cash withdrawals before the attack: 9.96 ETH on Oct 15, three of 0.1 ETH on Oct 17, and 0.99 ETH at 10:10 AM CT on Oct 22, less than an hour before proposal #12 was executed.

What Arkadiko says now

In its first statement on Oct 22, Arkadiko said it had disabled the malicious contract, paused governance, redemptions and liquidations, asked exchanges to freeze stolen funds, and was filing a police report.

In an update on October 25, Arkadiko said it had deposited additional collateral into the vault contracts, that vaults now have enough collateral to withdraw, and that users can repay debt on their own vaults. Redemptions remain paused. It said USDA was trading around $0.30 and that recovery efforts continue.

What this means

  • Governance is an attack surface. In both cases a contract that only looked like an upgrade was voted in through the protocol's own governance, and every vote in favor came from the attacker.
  • Low turnout is the weak point. Proposal #12 was open for nearly five days and passed with one voter, who cast all 4.57M DIKO about an hour before voting closed. On StackSwap, one other holder voted 20,000,000 against proposal #4, but the proposer's 20,037,754.99 votes for it still carried it. Anyone who can buy or borrow enough of a governance token can try the same where few holders review and vote.
  • Read the code, not the title. "AIP 32 - Update Vaults Operations for Reward Distribution" and "Swap V6 Upgrade - Dynamic Fee Tiers" were both published with source code that showed what they did. A function that sends any token to any address with no caller check is visible to anyone who reads it before the vote.
  • The trail stays public. The cash-out crossed three chains within about a day, and every hop above can be checked on public explorers.

If you lost money in a hack or any crypto theft, report it to ic3.gov and the FTC, and file a report at blockint.ai so others can see the addresses involved.

Sources