Arkadiko $1.09M Exploit: $51K Bought the DAO Vote

TL;DR

On October 22, 2026, a single wallet passed Arkadiko proposal 12 with 4.57M votes for and none against, registered a vault contract it had written itself, and drained about $1.09M from the Stacks lending protocol: 2,065,481 stSTX, 1.6522 sBTC, and 540,403 STX bought with freshly printed USDA. The votes cost about $51,000 against $1.09M taken, and about 77% of the STX that bought them came from a StackSwap governance takeover two days earlier. The contract's two drain functions never checked who was calling them, and the proposal handed it mint rights over USDA. Arkadiko switched the contract off about two hours later and paused governance, but by then USDA had lost its peg. About $909K of the proceeds had reached Tornado Cash or Bitcoin within a day. Bitquery counted 54 earlier proposals, every one filed by the team. The first outsider to file one took the vaults.

What is Arkadiko, and what did governance control?

Arkadiko is a collateralized debt position (CDP) protocol on Stacks, the Bitcoin layer-2. Users lock stSTX (StackingDAO's liquid staking token) or sBTC (a 1:1 Bitcoin-backed asset) in vaults and mint USDA against it. The Crypto Times describes USDA as a soft-pegged dollar token kept near $1 by a redemption mechanism that swaps it for vault collateral.

Governance controls everything. Arkadiko's own governance documentation says every contract upgrade must pass an on-chain vote: 0.25% of circulating DIKO to propose, 5% for quorum, more than 50% in favor to pass. The same page says nobody can change important pieces of the protocol "without explicit approval from the majority of DIKO holders."

In practice the majority was whoever showed up. Bitquery counted the thresholds at about 171,870 DIKO to propose and about 3.44M DIKO to pass. It counted 54 earlier proposals, all from the team's wallet, and only one that ever drew a vote against. The numbering is per contract: Arkadiko has run several governance contracts, each counting its own proposals, and this was proposal 12 on the current arkadiko-governance-v4-3.

How did the attacker get a contract through the vote?

At 20:10 UTC on October 17, the attacker's wallet deployed arkadiko-vaults-operations-v2-1. Twenty-five minutes later the same wallet filed proposal 12, titled "AIP 32 - Update Vaults Operations for Reward Distribution." The proposal's contract-changes field registered the new contract under the DAO name vaults-operations with can-mint true and can-burn false. In Arkadiko's design, a contract registered with mint rights can ask the DAO to print USDA.

The proposal linked Arkadiko pull request #624, "fix: settle stability fees before closing vaults," opened on June 21, 2026, by an outside account and still open. Bitquery calls the PR unrelated, and nothing public ties its author to the attacker. The PR's subject also echoes the name of the malicious contract's mint function, settle-fee-budget; nothing public shows whether that was chosen. A voter skimming the proposal would have seen a plausible title, a real fee-settlement fix in the official repository, and an AIP number in sequence.

The attacker filed with about 193,091 DIKO, just over the proposal threshold. Then nothing happened. Per Bitquery, nobody voted on proposal 12 for more than four days.

What did the malicious contract actually do?

It moved any token out of the vault pool and printed any amount of USDA, for anyone.

The deployed source is short and looks careful. The two admin setters, set-shutdown-activated and set-mint-fee, both assert that contract-caller is the DAO owner. claim-pending-yield even verifies that the pool it is handed matches the DAO's registered vaults-pool-active contract, which reads like defensive code.

What it lacks is a caller check. claim-pending-yield takes a token, an amount and a payout address, checks that the contract is not shut down, that settlement is enabled and that the amount is above zero, and calls withdraw on the real vault pool. settle-fee-budget takes an amount and a payout address and calls the DAO's mint-token for USDA. Neither function looks at the caller. The authorization checks sit on the two functions that cannot move money; the two that can move money check nothing except that the contract is turned on.

This is CWE-862, Missing Authorization. Given who deployed the contract, the omission reads as deliberate, and the checks on the harmless functions make a quick read look reassuring.

How was the vote won?

With a balance assembled from four places, most of it in the final hour.

Three transfers reached the voting wallet before the last buy: 193,091 DIKO from the attacker's second wallet on October 17, enough to file; 83,474 DIKO from the attacker's collection wallet on October 20, matching the 83,474 DIKO Bitquery lists as taken from StackSwap pools; and 905,444 DIKO from a further address at 14:16 UTC on October 22. At 15:03, about an hour before voting closed, the wallet made its last purchase: 3.39M DIKO for 145,918 STX, per Bitquery. At 15:06 it voted for proposal 12 with 4,573,197 DIKO, 6.7% of the counted supply. That cleared the roughly 3.44M passing threshold with about 1.1M to spare. Nobody voted against. At 16:04 the wallet called end-proposal itself, and the contract went live.

There was no timelock. The vote closing and the code becoming active were the same event.

Bitquery traced the funding. About 77% of the STX used to buy votes came from the StackSwap haul two days earlier, and about 5.23 ETH went through ChangeNOW on October 22 and came back as STX. The Ethereum side was pre-funded from Tornado Cash from October 3.

Bitquery puts the vote cost at about $51,000, and the attacker sold the DIKO afterwards and recovered about 8% of it. Against $1.09M taken from Arkadiko alone, that is about 21x before the resale, on a governance position held for about an hour.

The attack, step by step

#	Time (UTC)	Action	Evidence
1	Oct 17, 20:10	Attacker deploys `arkadiko-vaults-operations-v2-1` with no caller checks on withdraw or mint	Hiro contract source
2	Oct 17, 20:35	Files proposal 12 registering it as `vaults-operations` with `can-mint true`	Hiro propose tx
3	Oct 17-22	No votes cast for more than four days	Bitquery
4	Oct 18-20	Same operator takes StackSwap through a governance vote and drains 49 pools; STX proceeds later fund the DIKO purchase	Bitquery
5	Oct 22, 15:03	Buys 3.39M DIKO for 145,918 STX	Bitquery
6	Oct 22, 15:06	Votes 4,573,197 DIKO for; zero against	Hiro vote tx
7	Oct 22, 16:04	Calls `end-proposal`; contract becomes active immediately	Hiro end-proposal tx
8	Oct 22, 16:06	`claim-pending-yield` pulls 1.6522 sBTC from the vault pool	Hiro tx
9	Oct 22, 16:09	`claim-pending-yield` pulls 2,065,481 stSTX; `settle-fee-budget` prints 999,999,999 USDA	Hiro tx, Bitquery
10	Oct 22, 16:26	A second `settle-fee-budget` call prints 500M more, about 1.5B in total	Hiro tx
11	Oct 22, 16:28	First sale: 1,000,000 printed USDA for 514,425 STX	Bitquery
12	Oct 22, 18:08 / 18:14	DAO owner calls `set-shutdown-activated` on the attacker's contract, then pauses governance	Hiro tx, Bitquery
13	Oct 22, 19:21	DAO burns 1.499B USDA	Bitquery
14	Oct 23, 04:05	213.3 ETH deposited to Tornado Cash	Bitquery

The path branches across two DAOs and three exit chains.

rendering diagram…

How much was lost: $1.09M, $1.16M, or $7.1M?

$1.09M from Arkadiko is the figure we trust, and the reason is that it reconciles with the chain.

Arkadiko's own disclosure at 20:29 UTC on October 22 said a malicious contract had passed through governance and drained most of the assets in its vaults. Its preliminary estimate, as reported by The Crypto Times, was about 2 million stSTX and 1.65 sBTC. The chain matches: the stSTX call moved 2,065,481.479441 stSTX and the sBTC call moved 1.65221692 sBTC, both to a second attacker wallet that Bitquery ties to the asset withdrawals and USDA printing.

Bitquery values those at about $780,000 and $135,000, plus about $173,000 of STX bought with printed USDA, at the thief's own median STX sale price of $0.32. Using what the attacker actually received for the stSTX gives $1.11M instead, a 2% spread, so we keep Bitquery's $1.09M as the headline. Printed USDA is not counted separately; its cost shows up as the STX it pulled from the swap pool and in the depeg. Most of it never left: of about 1.5B USDA printed (999,999,999 in one call, 500M in another), Bitquery lists 1,338,000 USDA sold for 540,403 STX across several sales, and at 19:21 the DAO burned 1,499,009,720 USDA out of the attacker's own wallet. The six mint calls total about 1,500,355,000 USDA; minus the burn, about 1.35M was left to sell, which squares with Bitquery's figure.

$1.16M is Bitquery's total across both DAOs. It adds $70.5K taken from StackSwap in two separate takeovers: about $39K drained by the Arkadiko operator and $31K withdrawn by an older wallet Bitquery could not link to it. The $7.1M in some headlines adds Arkadiko to the unrelated X100 flash-loan takeover of the same week; the article body itself puts Arkadiko at $1.09M.

The Crypto Times also reported that Arkadiko's total value locked fell 90% in a day.

Where did the money go?

Out through three chains within about a day. Bitquery's snapshot at about 16:00 UTC on October 23 places about $1.06M of the $1.16M, counting $31K in the July wallet and $5.6K left in the thief's Stacks wallets:

Tornado Cash: about $513K. 213.3 ETH deposited on October 23, part of it from about $305K of USDCx burned for USDC and swapped.
Bitcoin: about $396K. Four paid sBTC peg-outs totaling 4.86 BTC sat for about 12 hours, then moved in eight payments to new addresses.
Swap services: about $114K. Roughly 1M STX went to 38 deposit addresses, one service labeled as ChangeNOW.

Arkadiko switched off the contract, paused governance, and asked exchanges to freeze the funds. It executed proposal 14 at 07:57 UTC on October 27 to reset vault operations to its legitimate v1-3 contract, per The Currency Analytics, which notes it did not recover the stolen collateral.

Was StackSwap the rehearsal?

On October 18 the operator filed StackSwap proposal 4, "Swap V6 Upgrade - Dynamic Fee Tiers," naming a new swap handler whose migration functions, per Bitquery, let one hard-coded wallet pull any pool's funds. The votes cost about $11,000. A separate wallet, active on StackSwap since July, took the swap role through an older proposal, voted against with 20,000,000 votes, and withdrew 98,034 STX from a pool. Proposal 4 passed anyway on October 20, 20,037,755 to 20,000,000, a margin of 0.19%. Within a minute, 51 calls drained 49 pools for about $39,000.

Bitquery found no on-chain link between the July wallet and the Arkadiko thief. The method matches Arkadiko: a routine-sounding upgrade title over a contract whose real purpose is a withdrawal path. At StackSwap, the July wallet voted against.

Why does this keep working?

Because a governance vote approves bytecode that most voters never read, and a quorum counts tokens, whoever holds them.

Build Finance DAO lost about $470,000 in February 2022 when one party voted itself control of the treasury and minting. BonkDAO repeated it at $20M in July 2026. Neutron lost $9.4M to a vote that handed over an admin role. The variable that matters in every one of them is a ratio: the market cost of the votes needed to pass, against the value the passed proposal can reach. Arkadiko's ratio was about 1 to 21.

Reviewing the vault code alone would not have moved that ratio; a code review certifies the contracts you showed it, on the day you showed it. The weak point was a process that let 5% of DIKO install replacement vault code with no delay and no second look.

What should DAO operators do?

Price your own governance. Compare the open-market cost of passing a vote today with the TVL and mint authority a passed proposal can touch. If the second is a multiple of the first, governance is your largest attack surface.
Put a timelock between the vote and execution. A delay of even 24 to 48 hours, with a guardian able to cancel, turns a drain into a public warning.
Diff every proposal's payload before it can pass. Proposal 12 registered, with mint rights, a contract deployed 25 minutes earlier by a wallet that had never proposed. All of it is readable from the proposal transaction. Have someone on the team read it like a pull request.
Restrict what governance can register. Mint authority over the stablecoin should not be grantable by a single proposal from an unknown deployer. Allowlist deployers for privileged DAO names.
Vote against the proposals you did not write. With no opposition, the attacker needed only quorum. A team that votes no on unvetted proposals raises the price of capture by its own stake.

What would have caught it before the vote?

The drain ran at 16:06 and 16:09, two and five minutes after voting closed at 16:04, faster than any human response.

The run-up was slower. Each of these sat on-chain before 16:04: a proposal registering a contract under a privileged DAO name with can-mint true over the stablecoin, from 20:35 UTC on October 17; that contract deployed 25 minutes earlier by a principal that had never proposed; zero votes for more than four days; one wallet buying 3.39M DIKO at 15:03 and casting the only votes three minutes later.

Those signals had a use. A rule firing on the October 17 proposal, a can-mint grant to a contract from a first-time deployer, had nearly five days of lead time before the vote closed. Passing needed more than 50% of votes cast in favor, so defeating the proposal would have taken more than the 4,573,197 DIKO the attacker eventually voted, about 6.7% of the counted supply. The public record does not show how much of that the team or large holders held. Nobody voted. The lever Arkadiko eventually used came from the attacker's own code: at 18:08 the DAO owner called set-shutdown-activated on the malicious contract, a setter that checks only for the DAO owner, and both drain functions refuse to run once it is set.

The cheaper defense was structural. About $51K of DIKO bought a 4.57M-vote position that cleared the roughly 3.44M passing threshold by about 1.1M votes, against vaults holding more than $1M, with no delay between the vote and the code going live. That ratio is what the governance and access-control review in our DeFi security audits measures. We price quorum on the open market against everything a passed proposal can reach, map every privilege a proposal can grant, and specify the delay, the cancel role and the proposal checks that give a team time and a lever when a mint grant from a first-time deployer appears.

Frequently Asked Questions

How much did Arkadiko lose in the governance attack?

About $1.09M, per Bitquery's on-chain valuation: 2,065,481 stSTX (about $780K), 1.6522 sBTC (about $135K), and 540,403 STX (about $173K) bought with printed USDA.

Was the Arkadiko exploit a smart contract bug?

No, not in Arkadiko's code. The missing authorization check was in the attacker's own contract: a new contract whose withdraw and mint functions skipped the caller check, registered through a governance vote with mint rights. The flaw was a governance process that let one wallet install replacement code with about 6.7% of DIKO and no timelock.

Would a timelock have stopped the Arkadiko attack?

Yes, if paired with a way to cancel. The contract became active the moment voting closed, and the vaults were drained two and five minutes later. A delay between passing and execution would have left the passed proposal, and its mint grant to a 25-minute-old contract, sitting in public before any funds moved. Arkadiko's governance had no such delay, and the public record does not show a cancel path for a pending proposal.

Arkadiko's $1.09M Governance Takeover: $51K of DIKO Bought the Vaults