Moneystack

🚨 Arkadiko Post-mortem(Using claude and surfAI) the attacker address provided by @ArkadikoFinance used Claude to trace the funds and cross-checked the results against public on-chain transactions. On October 22 (UTC), 2,065,481.479441 stSTX and 1.65221692 sBTC were drained from Arkadiko vaults. Attacker / fund recipient address: SP1JB85VZ7TX7SWSNW0PHV115YPQE5QXJDG6P60AQ Governance proposal / execution address: SP1V1BN459229EJG94YYBJDN50ADVB6MXVVEZ0G34 Proposal #12 passed with about 4.57 million DIKO in favor and 0 against, granting an attacker-deployed contract permission to withdraw collateral and mint USDA. The attacker also minted 1,500,354,999 unbacked USDA. That is the number of tokens minted, not $1.5 billion in losses. The funds moved as follows. Swaps The attacker swapped stSTX in 5 transactions for about 2.28 million STX. Selling USDA separately netted about 540,000 STX. Distribution From the recipient wallet, about 2.29 million STX and 1.65 sBTC moved to SPR3...SCY1, and about 514,000 STX moved to SP26...KJ18W. Bitcoin Through 4 successful withdrawals, 4.85824088 BTC was paid out to bc1q8h...j08s. That total includes sBTC acquired through additional purchases. The funds then moved to bc1q09...4qle, whose owner has not been identified. Ethereum Across 14 matched bridge transfers, 305,348.87 USDCx was burned on Stacks and 305,320.87 USDC was minted on Ethereum. At the receiving addresses 0x9a86...3875 and 0x4256...4073, the USDC was swapped for ETH. Tornado Cash A downstream wallet, 0xe8cb...5006, deposited 213.3 ETH across 9 transactions. However, other funds were commingled upstream, so the full amount cannot be attributed to the Arkadiko exploit. These figures include swaps and transfers of the same funds, so adding them all together would overstate the losses. The Binance and Bybit deposit routes in the image are marked as "speculative." I confirmed ETH transfers from Binance hot wallets to wallets linked to the incident. What hasn't been confirmed is whether the stolen STX was deposited into those exchanges beforehand. That's the flow. Honestly, I didn't even know governance was still active. I don't know yet how much can be recovered. But based on the public fund flows, I think it's highly likely that most of the direct selling pressure from this incident has already passed. A significant amount has already gone through the market, and my guess is that some of it went to exchanges. The next thing to watch is how much can be frozen and recovered through exchange cooperation and investigations. That said, with STX already carrying Binance's Monitoring Tag, the timing is a real headache. Of course, as an industry leader, Binance will know very well that a dApp exploit and a security flaw in the mainnet itself are different things. I don't expect this incident itself to directly affect Binance's judgment. But I don't think outsiders' trust in the ecosystem can be completely separated from it either. And of all times, this had to happen near the end of the month. I suspect relatively few users had active vaults at the time. But USDA holders and liquidity providers were also affected, so it's hard to call that a relief when people have lost money. Separately, this is something I've felt for a long time: the ecosystem's response in situations like this is disappointing. If the attacker addresses and suspected fund flows had been shared with the first official announcement, users could have worked together to trace the exploit and check for further risks. It would also have helped them assess their own exposure and decide what to do with their assets. But the initial announcement left out the addresses and routes needed to make those assessments and respond. I think the confirmed findings could have been shared, with the speculative parts clearly labeled as such. I understand that the Stacks ecosystem has a lot to navigate right now. Even so, these are exactly the moments when I'd like to see information shared early so the community can respond together. During the Cetus incident on Sui, multiple dApps stepped up alongside the foundation to coordinate a response. I think it matters to keep showing who is doing what, how they are working together, what progress has been made, and what still needs to be resolved. As a user, seeing that process gives you a sense that "even when something goes wrong here, the ecosystem comes together and works through it." I don't like the attitude that seems to treat publicly showing this kind of response as a blemish on the ecosystem. If you want to boast about a strong DeFi ecosystem over the long term, I think you also have to show up when an incident happens. If the position is that this is a decentralized ecosystem and individual projects are responsible for their own affairs, then claiming their DeFi successes as wins for the entire ecosystem whenever things go well is inconsistent. The SEC investigation concerning Stacks and Hiro was also closed in 2024. At the very least, I don't see why sharing attacker addresses, disclosing fund flows, and helping coordinate a response should still require so much tiptoeing. You can't have it both ways. From where I stand, it looks like "we're strong eco" when things go well, and "nothing to do with us" when funds get stolen. If this attitude persists, I believe the long-term cost will be far greater than the money stolen here: the loss of trust in the ecosystem. And it is the users and projects that stay who will end up paying that price.