On July 15, 2025, Arcadia V2 RebalancerSpot was exploited through an unvalidated router address parameter. Attacker registered a malicious router, flash-loaned $1.5B from Morpho Blue, bypassed health checks, and drained LP positions for $2.5M-$3.6M profit.