Secured Finance Restarts Arbitrum Lending Markets After $181K Exploit

Lending Markets Reopen on Three Chains

Lending markets are live again on Ethereum, Arbitrum (ARB), a Layer 2 network, and Filecoin, the three chains where fixed-rate DeFi protocol Secured Finance suspended operations after a September 7 unauthorized outflow. The restart took effect on October 16, confirmed in a post-mortem the team published with an October 18 date, and team lead Masa Kikuchi announced the completed restart on X the same day, thanking users who sat out the shutdown. During the roughly five-week suspension, users could not place new orders, deposit or withdraw, and both maturity processing and automatic rollover of matured positions were deferred. The team's SF Yield Vault, which uses those lending markets as a strategy, kept deposits and withdrawals restricted on its front end over the same period. According to the report, the Secured Finance Foundation absorbed the protocol's losses, and no user outside the development team lost funds. Pre-recovery impact totaled $180,856, roughly $181,000, split between a $176,196 protocol loss and $4,660 in collateral moved when a team member's personal account was improperly liquidated; both figures were valued as of September 16 and rechecked on October 5, so they are not the current unrecovered amount. Recovery work returned 31.5547 ETH, worth about $78,000 at the ETH price used when the incident was disclosed on September 11, roughly 44% of the protocol loss. The whitehat known as c0ffeebabe.eth and the block builder Ultra Sound carried out that work, combining a return of the drained funds with a refund of block-building fees. Operations applied the returned funds, together with foundation reserves, to the TokenVault contract that custodies the protocol's liquidity pools, then corrected the attacker's improper balances and positions, so no individual wallet refunds were required.

A Defect Flagged in May

The root cause, per the report, was a defect in the data structure of the order book that manages orders by price level. When orders were placed, partially filled and cancelled in a specific sequence, open orders were mistakenly treated as filled, producing positions and deposit balances with no actual trade behind them. The attacker used those fabricated claims to pull assets out of TokenVault. The report lists 14 unauthorized withdrawals and one liquidation against a team member's account as the main transactions, and states that the price oracles importing external market data were not manipulated. The timeline is the sharpest part of the document. An internal security review in late May had already identified the defect, and the corrected code was written and tested by June. The team judged it a minor inconsistency that would not interfere with order book operation and did not recognize the drain risk; under the policy in force at the time, contract changes required an external audit before production deployment, and the next audit had not been scheduled, so the patch sat unused. The team calls that judgment a mistake. The fix reached all three chains on September 24, but code alone could not unwind the fabricated state, so on October 9 the team executed recapitalization and position corrections and lifted the pause temporarily to process deferred maturities and automatic rollovers. Verification then surfaced stale records from already-processed orders, triggering a second pause on October 13. A scan on October 15 removed 17 stale records across eight order books and stripped out temporary recovery functions and permissions, clearing the way for the October 16 restart. Quantstamp assisted with attack reproduction, fix verification and fund tracing, though that review covered only the cause and the fix, not the protocol as a whole. The report also concedes a detection gap: the third-party anomaly detection service the team had used was discontinued, its replacement was not ready when the attack hit, and the investigation only began after a routine administrative process failed, about 28 hours after the first unauthorized withdrawal.

Monitoring Live, Re-Audit Pending

Read against the on-chain record and the team's own post-mortem, the response has already changed practice on all three chains: monitoring now watches liquidations and withdrawals meeting set conditions, order book validation tests were added, and any code change needs review and approval from at least one person other than the implementer. The foundation, in effect, served as the protocol's DeFi insurance backstop, absorbing what remained after the 44% whitehat recovery, at September valuations. Arbitrum (ARB) holders can pull supply context from our report on the 92.65 million ARB unlock and chart context from our Arbitrum technical analysis, plus an earlier note on ARB's slide below the daily pivot. What the response has not yet delivered is a full re-audit: Quantstamp's engagement was scoped to the root cause and the fix, and the team itself validated October's recovery and restart.