Orange Finance admin address was compromised on January 8, 2025, and used to upgrade contracts on Arbitrum and transfer $840K. Protocol had inadequate multisig implementation (effectively unisig); ~$731K remained.

The Arbitrum-based liquidity management project Orange Finance suffered a $830,000 asset theft due to a misconfigured multi-sig. The attacker gained ownership of each vault, modified their implementations, and withdrew both the deposited assets and excessively approved funds. About 94% (roughly $780,000) of the total loss came from deposited assets, while the remaining 6% (around $47,000) resulted from excessive approvals.