Compromised Admin Key Drains $843,556 From Orange Finance on Arbitrum

Arbitrum-based yield protocol Orange Finance lost $843,556.90 on January 9, 2025, after an attacker gained control of the project's administrative private key and used it to take over the protocol's smart contracts. The breach occurred overnight, sometime between Tuesday and Wednesday, leaving the team unable to intervene before funds began moving out.

01Mechanism

With the key in hand, the attacker pushed a contract upgrade that replaced Orange Finance's logic with code under their own control, then began pulling value out of the protocol's pools and vaults. The team later confirmed what had happened in a short statement: "The contract is no longer Orange," they wrote. Security firm PeckShield flagged the exploit shortly afterward, posting an alert urging holders to stop interacting with the compromised contracts and to revoke any related token approvals — by which point most of the outflow had already occurred.

Attacker address: 0x496e5a7ba67735c7ee5eb81ef07b65b909a31345

Attack contract: 0x17c8eA17F174B5fa49D5090933ff28cE2DF10a3c

02Transaction trail

Per the reconstruction published by the protocol, the attacker's on-chain actions ran as follows:

• Initial token sweep: 0x093673927fc38783d37717b4bd14693c29035fceff6a0c7747db21e88c4ea28f
• SYK reward drain: 0x855625c6775b0acd5048b0c94466f76c3c361e2269445e66ae7ae352f04f538f
• Vault access stripped: 0x14535a9c8e7d5fa2c94de52067a3cf93369273517532e0a06871ddceb3e67dd7
• Stryke positions burned, first batch: 0xad0d094c8ea32110ee3bc00d9ba040a79f5ba411296cef5e9b4d25a2c2e2a888
• Stryke positions burned, second batch: 0x1bab3323ed9d1bdea9f57809e47b93b0fc0cd154e003e96812c333dedd74c500
• WETH-USDC asset transfer: 0xecd160e3027b7bdd23423358f68b25eaaee08a9156f745390e14c7b7e9363195
• Approvals exploited: 0xe31cc5011c7c4ee0720674a38147f9d4765f09e138c4f1d15c45079e2b5507b3
• Closing token swaps: 0x38e5199e52eb602b48c7b63e818939908590d341e0b348c208decab146d0e556

From there, the funds were forwarded to a second address, 0xeB0f537A7a1C3E38d4F57026982c11F6886233D7, and finally bridged off the chain through Stargate, in this transaction.

03Losses by source

• Uniswap WETH-USDC: $135,709.63
• Uniswap USDC-ARB: $100,278.28
• Uniswap USDC-WBTC: $83,546.96
• Uniswap BOOP-WETH: $20,109.71
• Pancake WETH-USDC: $259,376.45
• Pancake USDC-ARB: $65,917.20
• Pancake USDC-WBTC: $146,541.50
• Sushi WETH-USDC: $15,519.62
• Sushi USDC-WBTC: $4,414.83
• OrangeDistributor: $12,142.71614

Combined, these figures break down into $783,966.93 in direct deposit losses, $47,447.26 attributable to exploited approvals, and $12,142.71614 in unclaimed SYK rewards, for a total loss of $843,556.90.

04Response

Orange Finance's first statement after the breach told users to stay away from the protocol and explained how to revoke contract approvals. A follow-up post confirmed that the team had also opened a direct line to the attacker, proposing a deal in exchange for returning the funds:

"If you respond positively to our offer within 24 hours, we guarantee that no law enforcement agencies will be involved, and the matter will be treated as a white-hat hack."

05Root-cause findings

A post-incident review from the team identified several gaps that allowed the breach to happen: there was no system in place to monitor for suspicious activity, controls around who could exercise privileged functions were weak, and — the central issue — the multi-signature wallet intended to protect admin operations only required one signer to approve a transaction. Orange Finance says it will share a full breakdown of losses by user, while it has not yet disclosed how the key was exposed in the first place — an inquiry the team says is still underway.