On 22 October 2026 Arkadiko, a lending app on Stacks, said it had been hit through its own governance. A malicious contract was approved by the voting and execution process and then used to withdraw assets from the protocol’s vaults. The team’s preliminary figures were about 2 million stSTX and 1.65 sBTC. stSTX is a liquid-stacking token, a claim on STX locked for Stacks rewards. sBTC is a bitcoin-backed token used inside Stacks apps, meant to track bitcoin one for one. Arkadiko has not published a dollar total, attacker addresses, or a transaction list. A round number in someone else’s thread is not the protocol’s books.
The team said it disabled the malicious contract, paused governance, and halted vault redemptions and liquidations. People with stSTX or sBTC vaults cannot change those positions while the collateral is gone. The team said the exchange inside the app, and other STX vault functions, were still operating. It said it had asked exchanges to freeze stolen assets and that it was filing a police report. That is a company and a protocol asking other companies for help. It is not a refund, and it is not a halt of Stacks or of Bitcoin.
What happened
Arkadiko is governed by DIKO. Its own documentation says a contract change is an on-chain vote: a proposer needs a small slice of circulating DIKO, a vote needs a quorum, and a proposal passes if more of the votes are yes than no. The design is the story. If the stake required to pass a change is cheap next to the collateral the change can move, the vote is the bug. Arkadiko has not, in the post this page is using, explained how this proposal cleared the bar, who voted, or why the contract was not caught before it ran. We will not supply that missing how-to. Neutron’s September vote, which cost on the order of $20,199 and handed over admin rights, is the same shape on a different chain. Cosmos Hub restarted and moved 1,227,121 ATOM is that other incident, including the October votes about giving the recovered coins back. Arkadiko did not get a chain-level state rewrite. Stacks kept producing blocks.
USDA is Arkadiko’s dollar-shaped token, borrowed against vault collateral. When the collateral leaves, the token is a claim on a vault that no longer holds what the screen implied. Outside reports said USDA traded below its peg after the withdrawals. A peg in a market quote is a price. The missing collateral is the product failure. See stablecoins: useful, not magic. See DeFi is software with rules you cannot call support about. The support here is a paused governance module and a police report.
Do not mash this into Initia halted after unbacked tokens left a bridge, the next day’s chain pause. That was a chain and its rollups stopped. This is one app’s vote, on a network that did not stop. Do not mash the sBTC in these vaults into bitcoin in a wallet you hold. sBTC is a token on Stacks that is supposed to be backed by bitcoin. Backing is a reserve and a set of signers. It is not the coin in the reserve.
Why it matters
If you lent stSTX or sBTC to an Arkadiko vault, your position is frozen in the team’s account, and the collateral the vault was supposed to hold is what the attacker withdrew. If you held USDA, you held a token whose advertised backing sat in those vaults. If you held DIKO and did not vote, you were part of a quorum that can pass when almost nobody is looking. Delegating a vote, or leaving it uncast, is a custody decision about the contracts, not a comment on a forum.
A governance token is not a lock on the treasury. It is the key, split into pieces small enough to buy. The Cosmos page made that point for ATOM and Neutron. This page is the same point for a Stacks lender, with a smaller pot and no validator halt behind it.
What happens next
A post-mortem with a dollar figure the protocol is willing to sign, freeze requests that other venues may or may not honour, and an argument about whether governance should be turned back on before the contract list is boring again. Any recovery that sells a reserve of DIKO, or socialises a loss across USDA holders, would be a later decision. Governance is paused, so that decision is not a button someone already pressed. Watch Arkadiko’s own updates. A claim site that asks for a seed phrase is not one of them.
Not a recommendation to buy, sell, bridge, or vote DIKO, STX, sBTC, or USDA. Not an instruction to interact with a contract address posted under this incident.
