Decentralized-finance protocol Arcadia Finance has suffered an exploit that drained roughly $3.5 million from its liquidity pools on Coinbase-backed layer-2 network Base, according to blockchain-security firms Cyvers and PeckShield. On-chain data show the attacker manipulated the protocol’s rebalancer contract by supplying arbitrary “swapData,” enabling a series of transactions that siphoned funds, converted them into about 840 ether and bridged the assets from Base to the Ethereum mainnet. Cyvers later detected a follow-up wave of transactions that lifted an additional $1 million, bringing the total losses to around $3.5 million. Arcadia has paused affected contracts and urged users to revoke asset-manager permissions while it investigates the breach. Security researchers are tracking the attacker’s wallet movements as the protocol explores potential recovery measures.