arcadiafi on base exploited for ~2.5m via 'swapdata' on rebalancer contract. attacker drained another ~1m after bridging stolen eth to ethereum.
518