One wallet voted itself Arkadiko's vaults. On StackSwap, two thieves used the same trick
We read every Stacks transaction behind the Arkadiko drain and followed the money onto Bitcoin and Ethereum. On the way we found two unreported takeovers of StackSwap, another Stacks exchange.
- $1.16M
- 1 voter
- $51k
- 0.19%
- 98,034 STX
- 213.3 ETH
01 · What happenedOne wallet voted, and Arkadiko's vaults were drained
On 22 October, someone drained Arkadiko. Arkadiko is a lending app on Stacks, a network that runs apps on top of Bitcoin. It runs its own exchange too. People lock coins in Arkadiko and borrow USDA, a coin meant to stay worth one dollar. By that evening most of the locked coins were gone, and the thief was dumping USDA for about 13 cents.
The thief got in through a vote. Arkadiko lets holders of its token, DIKO, vote on changes to the app. One wallet bought enough DIKO to pass a change on its own. Nobody else voted. The change plugged in a small program that let whoever called it take the locked coins and print as much USDA as they liked.
Arkadiko called it a governance attack, an attack through its own voting system, in a post that night. It has not yet said how the vote was won.
Bitquery traced the whole thing. We read the Stacks record directly and followed the money onto Bitcoin and Ethereum with Bitquery's data. The record shows how the votes were bought and what the code did. It also shows another Stacks app, StackSwap, taken over the same way two days earlier. There, two different wallets raced for the same key. In all, $1.16M was taken. About half of what left Stacks went into Tornado Cash, a mixer that hides where coins go next. What the record cannot show is who is behind the wallets.
02 · How Arkadiko worksVaults, USDA and the DIKO vote
A vault holds the coins behind a loan. You lock coins as collateral and borrow USDA against them. Arkadiko's vaults take STX, the coin of Stacks, and a few other coins. Two matter here: stSTX, which is staked STX that earns rewards, and sBTC, which is Bitcoin brought onto Stacks one for one. The locked coins sit together in one shared pool, run by a contract, a program that lives on the chain.
Arkadiko is run by its DAO, a master contract that decides which other contracts may print USDA or move money out of the pool. Changing that list takes a proposal, which is a request that DIKO holders vote on. The rules count DIKO without the team's locked tokens. You need 0.25% of that count to make a proposal. Voting stays open for five days. After that, if votes reach 5% of the count and yes beats no, anyone can close the vote, and the change takes effect.
Nothing in Arkadiko's rules looks at what the new contract does. They check balances and counts. That leaves the reading to the people who vote, and on proposal 12 nobody did.
03 · One voterA stranger's proposal and a single vote
The proposal went up at 20:35 UTC on 17 October. Its title, "AIP 32 - Update Vaults Operations for Reward Distribution", reads like routine upkeep. It linked to a pull request on Arkadiko's GitHub. That pull request is real. But it is an open fix from June, by an outside account, and it edits a different contract. The proposal itself swapped in a new vault contract. The proposer had put it on the chain 25 minutes earlier.
The thief bought just over the 0.25% it needed, for about $700, and filed 43 minutes later. That was a first. Every one of the 54 proposals before it came from the team's own wallet.
For more than four days nobody voted, for or against. Then, on 22 October, the thief went shopping. It bought most of the DIKO it needed on the app's own exchange. It voted 3 minutes later with 6.7% of the DIKO the rules count, which cleared the 5% bar and beat 7 of the team's 11 proposals on the same voting contract. Voting closed an hour later. The votes cost about $51,000, and after the vote the thief sold the DIKO and got 8% of that money back.
04 · What the contract didTwo functions with harmless names
The contract that proposal 12 added had two functions that mattered. Both had dull names. One was called "claim pending yield". It took any amount of any coin out of the vault pool and sent it to any address. The other was called "settle fee budget". It printed any amount of USDA for anyone.
Neither function checked who was calling. Once the DAO approved the contract, the vault pool and USDA obeyed it.
05 · The drainFive minutes to take the vault pool's stSTX and sBTC
The thief ended the vote itself just after 16:00 UTC, and two minutes later it took all the sBTC in the vault pool. Three minutes after that it took all the stSTX and printed a billion USDA in the same block. Most of the pool was gone. Within the hour it had printed 1.5 billion.
Printed USDA is worth something only if someone will swap real coins for it, and the app's own exchange was still open. In one trade, the thief sold a million printed USDA into Arkadiko's STX-USDA pool and took out about $165,000 in STX. Those coins belonged to the pool's liquidity providers, the people who deposit coins so others can trade. Over the next hour the thief sold all the stSTX for STX too.
Arkadiko switched the contract off about two hours after it went live, then paused voting. That evening its DAO burned the printed USDA still sitting in the thief's wallet, more than 99% of it, so most of the printed coins never reached a market. The stSTX, the sBTC and the STX from the pool were already gone.
06 · StackSwapTwo days earlier: two wallets, one key
StackSwap is a DEX on Stacks, a trading app that runs on the chain itself. Its pools obey one address, the one its DAO names as "swap". Whoever holds that role can move any pool's coins. StackSwap is run by votes too, in vSTSW, which is its STSW token locked up for a fixed term.
On the morning of 18 October a new wallet, funded by the Arkadiko thief, deployed a contract dressed as a StackSwap upgrade. Its swap functions did nothing, while its "migration" functions let one hard-coded wallet pull any pool's coins. The wallet proposed it as StackSwap's new swap contract, under the title "Swap V6 Upgrade - Dynamic Fee Tiers". Within hours it had bought and locked enough STSW for just over 20 million votes. They cost about $11,000.
Another wallet already had a way in. Back in July it had filed StackSwap's proposal 3, "Add STX-aeUSDC pair". Despite the title, it handed the swap role to that wallet itself, a plain wallet with no contract behind it. The wallet voted it through and left it unfinished for three months. Hours after the thief filed its proposal, the July wallet finished proposal 3 and took the swap role, and late on 19 October it voted no on proposal 4 with 20 million votes.
The July wallet used the swap role minutes after its no vote. Just after midnight on 20 October it pulled about $31,000 in STX out of StackSwap's STX-USDA pool, and it still holds the STX.
The no side lost by 0.19%. When proposal 4 closed later that day, the swap role moved to the thief's contract, which drained 49 pools in under a minute. The haul was worth about $39,000, and nearly all of it, as STX or DIKO, went on to pay for the Arkadiko vote. The contract also took four other tokens the thief has not sold, and we did not value them.
We found no on-chain link between the two wallets. We found no report of either takeover when we checked on 23 October.
07 · What was taken$1.16M taken, and how we priced it
Arkadiko lost $1.09M, most of it the coins in the vault pool. StackSwap lost $70.5k across its two takeovers.
STX is valued at the thief's median sale price, about 32 cents. stSTX is valued at about 1.18 STX, the rate the thief's first sales got. Its last two sales, 40% of the stSTX, went through another pool for just under 1 STX each. Bitcoin is valued at the market price when the drain began, from Bitquery's price data. Printed USDA is not counted by itself. We count the STX it bought out of Arkadiko's pool.
| Taken from | Asset | Amount | Value |
|---|---|---|---|
| Arkadiko vault pool | stSTX | 2,065,481 | $780k |
| Arkadiko vault pool | sBTC | 1.6522 | $135k |
| Arkadiko swap pool | STX bought with 1,338,000 printed USDA | 540,403 | $173k |
| StackSwap pools | STX | 32,448 | $10k |
| StackSwap pools | USDA (sold for 82,380 STX) | 24,147 | $26k |
| StackSwap pools | WELSH (sold for 6,559 STX) | 25,071,894 | $2.1k |
| StackSwap pools | DIKO (used as votes) | 83,474 | $288 |
| StackSwap pool (July wallet) | STX | 98,034 | $31k |
| Total | $1.16M |
The losses land on different people. Borrowers with stSTX or sBTC in their vaults lost the coins behind their loans. People who had put coins in Arkadiko's STX-USDA pool paid out real STX for USDA nobody could redeem. USDA holders were left with a coin the thief had been dumping for about 13 cents.
08 · Where the money wentBitcoin, Ethereum, then Tornado Cash
The money left Stacks three ways, worth $1.02M in all.
The sBTC went back to Bitcoin. sBTC can be turned back into real bitcoin through a peg-out, a withdrawal the sBTC network signs off on. Besides the vault's 1.65 sBTC, the thief had bought about 3.65 more with STX from the drain, and it sold 0.44. It asked for seven withdrawals. The network's signers turned down three, and each time the sBTC went back to the thief. The four that went through paid 4.86 BTC to a fresh Bitcoin address. From there the coins moved on to a second address and sat for about 12 hours. Bitcoin's record is open through Bitquery's Bitcoin API, and the full history is sold as files as the Bitcoin dataset.
| Requested | BTC | Fee offered (sats) | Result |
|---|---|---|---|
| 22 Oct 16:31 | 1.6522 | 680 | Turned down, 22 Oct 20:01 |
| 22 Oct 20:10 | 1.3255 | 340 | Turned down, 23 Oct 01:10 |
| 22 Oct 20:11 | 0.9941 | 340 | Turned down, 23 Oct 01:10 |
| 22 Oct 20:23 | 0.0100 | 4,500 | Paid, 23 Oct 00:19 |
| 23 Oct 00:10 | 0.5000 | 1,440 | Paid, 23 Oct 01:10 |
| 23 Oct 00:22 | 2.0285 | 80,000 | Paid, 23 Oct 01:13 |
| 23 Oct 01:26 | 2.3197 | 80,000 | Paid, 23 Oct 02:05 |
Then, on the afternoon of 23 October, the bitcoin moved again. From 14:46 UTC the wallet sent out eight payments, seven of them to new addresses, and when we checked, about 80 minutes later, it was empty, with its last 1.71 BTC waiting to confirm. Four payments so far, worth 1.49 BTC, carry an on-chain note ending in "lifi": one from that wallet and three from the new ones. That points to LI.FI, a service that routes swaps between chains.
The dollars went to Ethereum. Stacks has its own copy of USDC, called USDCx, that can be burned on Stacks and claimed as real USDC on Ethereum. The thief swapped STX and sBTC into about $305,000 of USDCx and burned it all. The USDC landed in two of the thief's wallets there and was swapped into ETH. Bitquery's Ethereum API and the Ethereum dataset show every step.
The rest went through swap services, sites that trade one coin for another. The thief sent about a million STX, worth $320,000, to 38 one-time deposit addresses that fed two services. Our address labels mark the wallet that paid ETH back for the first as ChangeNOW's hot wallet. The flows match both ways: ETH in for STX before the vote, STX in for ETH after it. More ETH arrived from Binance hot wallets, the Chainflip and Bridgers bridges and one wallet with no label, which fits the second service's payouts. About $114,000 worth of that STX paid out somewhere we could not find.
On Ethereum the dollars and the swapped STX came back together. On the morning of 23 October, 213.3 ETH went into Tornado Cash within minutes.
09 · How the votes were paid forTornado Cash in, Tornado Cash out
The thief's Ethereum wallets were funded from Tornado Cash, starting on 3 October, weeks before its StackSwap takeover. The biggest withdrawal came a week before the vote. We looked at who uses the mixer in our Tornado Cash audit.
About half an hour before the vote, the main wallet sent a little over 5 ETH to ChangeNOW in six payments. Each time, STX turned up on Stacks a few minutes later. The rest of the voting money came from StackSwap: half an hour after selling its haul there, the thief sent the proceeds toward the wallet that would vote. In all, 77% of the STX sent toward the voting wallet came from StackSwap.
10 · What it meansWhat the governance attack means for users and DAO votes
The Crypto Times reports that Arkadiko has switched the contract off, paused voting and frozen the vaults. The same report says the team has asked exchanges to freeze the stolen coins and is filing a police report. Borrowers whose vaults held stSTX or sBTC are stuck for now: the coins behind their loans are gone, and the vaults are frozen.
StackSwap is still exposed. When we checked on 23 October, its swap role still pointed at the thief's contract, so that contract still decides what happens to coins in StackSwap's pools. Until StackSwap takes the role back, do not add coins to its pools.
Arkadiko and StackSwap shared a weakness. Their votes count the tokens behind a proposal. They never look at what the proposal does. Proposal 12 came from a wallet that had never proposed anything. It linked to an unrelated pull request and asked for the right to print USDA. It sat in public for more than four days. The votes cost about $51,000 and put $1.09M within the thief's reach. On StackSwap, the only no vote came from a wallet that already held the swap role.
If your coins were in an Arkadiko vault or pool, follow Arkadiko's own channels for updates. Do not pay anyone who offers to get the coins back.
11 · How we traced itMethod and limits
We pulled every transaction of the thief's Stacks wallets from the public Stacks record, with every event inside each one and the full code of both fake contracts. We read the vote counts straight from Arkadiko's and StackSwap's voting contracts. Each sBTC peg-out and USDCx burn names a Bitcoin or Ethereum address, and we followed those with Bitquery's data and labels. Two separate reviews rebuilt every figure and claim from the raw data, and their fixes are in this version.
Any Bitcoin or Ethereum wallet here can be followed with the Bitquery MCP. It lets you ask an AI assistant where a wallet's money went. We traced other recent thefts the same way, including the CoinDCX hack, the NGRAVE LIQUID theft and the Liquid peg-out attack.
We read balances at about 16:00 UTC on 23 October. The bitcoin was moving as we read it, and its last payments had not yet confirmed.
We read the 'lifi' notes on the Bitcoin payments as swaps routed by LI.FI. We have not yet traced where those swaps paid out.
The record shows which wallets moved money and when. It does not show who controls them, and we found no on-chain link between the July wallet on StackSwap and the Arkadiko thief.
Values use the thief's own trades: STX at $0.32, its median sale, and stSTX at 1.18 STX, the rate of its first sales. At what it actually got for all the stSTX, the total would be $1.11M. Arkadiko's own count may differ.
We call the first swap service ChangeNOW because Bitquery's address labels mark its Ethereum hot wallet that way and the flows match in both directions. We could not name the second service; the ETH we tie to it is matched by timing and size.
About 355,500 STX sent to the swap services paid out to addresses we could not find.
We read proposal counts from Arkadiko's six governance contracts and DIKO supply on 23 October, so the 0.25% and 5% bars are approximate for earlier dates.
12 · The addressesWhere to look
These are the main wallets and contracts in this story.
| Role | Address |
|---|---|
| Thief: proposal 12, the vote, the drain | SP1V1BN459229EJG94YYBJDN50ADVB6MXVVEZ0G34 |
| Thief: took the drained assets and printed USDA | SP1JB85VZ7TX7SWSNW0PHV115YPQE5QXJDG6P60AQ |
| Thief: collection wallet, peg-outs, USDC | SPR3KWTVF3ZKPW256Y6233WFJVHHMX92PQ0FSCY1 |
| Thief: StackSwap takeover | SP1BPT084EN10WTVGYNGF9J2ZF1F2CZJJGNH0NDAG |
| July wallet on StackSwap | SP3M69JEE4CHXSPV4GCVP282Z40802SRE3K8N2CWC |
| Malicious Arkadiko contract | SP1V1BN459229EJG94YYBJDN50ADVB6MXVVEZ0G34.arkadiko-vaults-operations-v2-1 |
| Fake StackSwap swap contract | SP1BPT084EN10WTVGYNGF9J2ZF1F2CZJJGNH0NDAG.stackswap-swap-v6a |
| Peg-out address | bc1q8hgk37ejgss57qthjq2l33vten46yg3wxsj08s |
| Held the 4.86 BTC until 23 Oct | bc1q09hhndrn9aj5jqn508jq0tmcaz4vkvleum4qle |
| Main ETH wallet | 0x9a868f1db69d609a8efe14d979c53ebddd2a3875 |
| Second ETH wallet | 0x425679fa1ab564815df9cbd91be68fc27c644073 |
| Sent 213.3 ETH to Tornado Cash | 0xe8cbdc3bb8e7af91f0b7aa91696c5624b4d05006 |
Follow the Arkadiko money in plain English
The Bitcoin and Ethereum side of this story comes from Bitquery's data. The Bitquery MCP server puts that data behind an AI assistant, so you can ask where a wallet's money went, or which labels an address carries, without writing a query. The full histories are also sold as files on the Bitquery Data Store, as Bitcoin and Ethereum datasets.
This article is provided for informational and educational purposes only and reflects analysis of publicly available on-chain data as of the dates indicated. It does not constitute legal, financial, compliance, or investment advice, and nothing in it is a recommendation to buy, sell, hold or withdraw any token or asset, or to use or avoid any protocol, exchange or service.
The findings describe transactions and balances observed on Stacks, Bitcoin and Ethereum between July and 23 October 2026. Attributions come from Bitquery's address labels and from on-chain behaviour; they may be incomplete or incorrect and may be revised as more data becomes available.
References to Arkadiko, StackSwap, ChangeNOW, Binance, Chainflip, Bridgers, Tornado Cash or any other named project, company, service or person describe what the public record shows about addresses and transactions linked to them, and what those parties have said in public. They are not statements about any party's intent, security practices, solvency or conduct, and nothing here asserts that any named party acted unlawfully or negligently. The wallets that took the funds are described by their behaviour and attributed to nobody.
Nothing herein should be relied upon as a definitive determination of fact. Readers should conduct their own independent verification before taking any action. The authors and publisher accept no liability for any loss or damage arising from reliance on this material. All trademarks and company names are the property of their respective owners.
Reported by Gaurav Agarwal for Bitquery Research, with AI tools; every figure was checked against the raw data.
FAQ
Was Arkadiko hacked?
Yes. On 22 October a single wallet passed Arkadiko's proposal 12 with its own DIKO, and nobody else voted. The proposal added a contract that let the wallet take the vault pool's stSTX and sBTC and print USDA. Arkadiko calls it a governance attack.
How much was taken in the Arkadiko hack?
About $1.09M from Arkadiko. Most of it was vault collateral, and the rest was STX bought with printed USDA. With StackSwap, the total comes to $1.16M.
Why did USDA lose its peg?
The collateral behind USDA was taken, and the thief printed new USDA and sold part of it for STX at about 13 cents each. Arkadiko burned most of the printed USDA, but the stSTX and sBTC that backed USDA were gone.
Was StackSwap hacked too?
Yes, twice, by the same method. One wallet took StackSwap's swap role through a proposal filed in July and pulled about $31,000 in STX. The Arkadiko thief then won its own proposal by 0.19% and drained 49 pools.
Where did the stolen money go?
Most of it left Stacks. Bitcoin worth about $396,000 went to one wallet, which began sending it on to new addresses the day after the hack. Most of the rest became ETH, and 213.3 ETH went into Tornado Cash.