For about $51,000, a single wallet bought enough DIKO to win Arkadiko’s governance vote. It voted 58 minutes before the poll closed, faced no opposition, and within minutes of its proposal going live it had taken about $1.09 million from the protocol’s vaults.
The vote was proposal 12 on Arkadiko, a lending protocol on Stacks. On paper, it ran for five days. In practice, it was decided in under an hour by a wallet that had owned almost none of its voting power the day before. Let’s go through Bitquery’s on-chain investigation to rebuild three things: what the vote cost, what the proposal actually did, and exactly what left the vault.
A Five-Day Vote Decided in 58 Minutes
According to Bitquery’s investigation, the attacker filed proposal 12 on October 17 at 20:35 UTC. It was titled “AIP 32 – Update Vaults Operations for Reward Distribution.” On the same day, the wallet bought 193,091 DIKO, enough to clear the 0.25% threshold required to submit a proposal.
Then it waited. For almost five days, nobody voted. On October 22, the wallet moved quickly:
- 15:03 UTC: bought 3.39 million DIKO for 145,918 STX on Arkadiko’s own exchange
- 15:06 UTC: voted with its entire balance
- 16:04 UTC: voting closed and proposal 12 went live
The final tally was 4,573,197 DIKO in favor and zero against. That’s 6.7% of eligible supply, comfortably above the 5% quorum set out in Arkadiko’s governance rules, which puts quorum at roughly 3.4 million DIKO. The attacker cleared it by about 1.13 million DIKO.
Context makes the outcome less surprising. Before proposal 12, all 54 earlier proposals had come from the team’s wallet. Voters were used to approving the team’s routine upgrades, not checking an unfamiliar proposal for problems.
How Cheap Was Arkadiko’s Governance?
Bitquery puts the total cost of the vote at about 158,139 STX, or roughly $51,000. The attacker sold its DIKO after the vote and got back about 8% of that, bringing the net cost to around $47,000.
Measured against what came out of the vault, that’s a return of about 23 times the net cost.
How the attacker paid for the vote is just as notable. According to Bitquery, 77% of the STX used to buy DIKO came from a separate attack two days earlier. On October 20, the same wallet operator took over StackSwap, another Stacks exchange, with a governance proposal that passed on just 37,755 votes, or 0.19% of supply. Fifty-one calls then emptied 49 StackSwap pools in under a minute. The rest of the funding came from Ethereum: about half an hour before the Arkadiko vote, the attacker’s main Ethereum wallet sent 5.23 ETH to ChangeNOW, and STX arrived on Stacks minutes later.
In other words, the attacker funded Arkadiko’s governance mostly with money taken from another protocol’s governance two days earlier.
This is a darker side of what I covered in “Can a Big Airdrop Kill a Crypto Project? Here’s What 2026 Closures Reveal.” When a governance token’s price falls far enough, control of the protocol can cost less than the assets the protocol holds. Arkadiko’s total value locked was about $1.4 million before the attack. Its quorum could be bought for about $51,000.
What the Proposal Really Did
Proposal 12 claimed to link to GitHub pull request #624. Bitquery says that’s an unrelated, still-open fix from June, submitted by an outside account. What the proposal actually did was replace Arkadiko’s vault operations contract with one the attacker wrote: arkadiko-vaults-operations-v2-1.
That contract had two functions with harmless-sounding names:
- “claim pending yield” moved any amount of any token from the vault pool to any address.
- “settle fee budget” printed any amount of USDA, Arkadiko’s stablecoin, to any address.
Neither function checked who was calling it. Each only checked that the contract was enabled and that the amount was above zero. Once the vote passed, the contract gave its caller full control of the vault.
What Left the Vault
From there, it took minutes:
- 16:06 UTC: all the sBTC in the vault pool was withdrawn
- 16:09 UTC: all the stSTX was withdrawn, and 1 billion USDA was printed
- 16:28 UTC: 1 million printed USDA was sold for 514,425 STX
Over the whole attack, the contract printed 1.5 billion USDA. Bitquery’s breakdown of what actually left Arkadiko:
- stSTX: 2,065,481 tokens, about $780,000
- sBTC: 1.6522 tokens, about $135,000
- STX from Arkadiko’s swap pool, bought with printed USDA: 540,403 STX, about $173,000
That adds up to about $1.09 million. Bitquery values STX at $0.32 and stSTX at 1.18 STX. At the price stSTX actually sold for, the Arkadiko total comes to about $1.11 million. Including the two StackSwap takeovers, about $70,500, the total across both protocols is around $1.16 million.
The printed USDA was sold at around $0.13, which broke the peg. With the stSTX and sBTC backing gone, USDA had little left to support it. Arkadiko switched off the contract at 18:08 UTC, paused governance at 18:14 and burned 1.499 billion of the printed USDA at 19:21. By then, the collateral had already left. Arkadiko’s TVL dropped about 90%, to roughly $141,600, compared with a peak of about $24.6 million in March 2024.
Following the Money, and the Buyer
Who bought Arkadiko’s governance? On-chain, the trail leads to a set of wallets with no public identity. The main address is SP1V1BN459229EJG94YYBJDN50ADVB6MXVVEZ0G34, which filed proposal 12, voted and drained the vault. Its Ethereum side was funded through Tornado Cash, with 12.2 ETH withdrawn between October 3 and October 22. That’s planning that began nearly three weeks before the vote.
The stolen funds were split across several routes:
- Bitcoin: four sBTC peg-outs paid out 4.86 BTC, and Stacks signers rejected three more. Four later payments totaling 1.49 BTC include a “lifi” note, pointing to the LI.FI cross-chain swap service.
- Ethereum: about $305,000 in USDCx was converted to USDC and swapped into 127.7 ETH. On October 23 at 04:05 UTC, 213.3 ETH went into Tornado Cash, part of about $513,000 in Tornado deposits overall.
- Swap services: about 1 million STX, roughly $320,000, went to 38 deposit addresses feeding two instant-exchange services. Bitquery’s labels identify one of them as ChangeNOW.
About $114,000, roughly 355,500 STX in swap-service payouts, hasn’t been traced yet.
Arkadiko called it a “governance attack” in a post on X on the evening of October 22. It has frozen the affected vaults, asked exchanges to freeze stolen funds and is filing a police report. A separate wallet also took 98,034 STX from StackSwap during the same period. Bitquery found no on-chain link between that wallet and the Arkadiko attacker.
Why Small DAOs Are Easy Targets
Arkadiko’s governance rules worked exactly as written. The proposal cleared its threshold, reached quorum and passed with a majority. What failed was everything around those rules:
- No timelock. Arkadiko’s documentation says an approved proposal becomes part of the protocol once voting ends. The malicious contract was live two minutes after the vote closed.
- A quorum set in tokens, not dollars. A 5% quorum is meaningful when a token is worth something. When it isn’t, it’s an asset anyone can buy.
- Nobody watching. Fifty-four team-submitted proposals had set a habit of passing upgrades without review. An outside proposal with a misleading GitHub link drew no votes against it in five days.
Arkadiko’s Security Module could cover part of the shortfall by selling up to 30% of staked DIKO, but using it requires a governance vote, and governance is paused. Any recovery plan will depend on the same voting system the attacker exploited.
For every small DAO that holds more in its vaults than its governance token is worth, Arkadiko shows the risk is practical, not theoretical: an attacker with about $51,000 and a protocol nobody is watching.
Disclosure: This is not trading or investment advice. Always do your research before buying any cryptocurrency or investing in any services.
Follow us on Twitter @themerklehash to stay updated with the latest Crypto, NFT, AI, Cybersecurity, and Metaverse news!
Be the first to comment