Mentioned in This Article
1. What did the Arbitrum Security Council do on October 30?
On October 30, Arbitrum's Security Council moved 74,559,805.2 ARB and roughly 8,426 ETH out of an address that its own public notice tied to the Binance exploit, and it did so without holding that address's private key. An analysis posted on November 2 by Zealynx on the Ethereum Magicians forum lays out how the council used its upgrade powers so that the transfers appeared to be sent by the holder itself.
The transfers were executed at 8:08 a.m. Hong Kong time. In its notice, the council described the address as connected to what it called the day's Binance exploit. The action drew attention because it shows, in concrete technical detail, what an emergency body can do on a network that markets itself around user self-custody.
2. Background: what is the Arbitrum Security Council?
Arbitrum is a layer-2 network, a system that processes transactions off the main Ethereum chain while posting its records back to Ethereum for settlement. Arbitrum One is its flagship chain, and ARB is the governance token used by ArbitrumDAO, the community body that votes on the network's rules and treasury.
The Security Council is a group of signers that can act quickly when a serious problem appears, such as an active exploit or a critical software flaw. Its members act together through a Safe, a widely used multisignature wallet that requires a minimum number of approvals before a transaction can go through. Here the threshold is nine of twelve signers, so no single member can act alone.
Emergency councils exist because decentralized governance votes are slow by design. A proposal must be drafted, debated and voted on, and a thief can move assets in minutes. A standing council trades some decentralization for speed, and the Arbitrum design places that trade-off in plain view by assigning it to a named, elected body whose actions are announced publicly.
The Binance freeze is a test of that arrangement because the funds involved were large and the context was a theft of about $6.3 billion, the kind of event for which emergency powers are intended. The same powers raise a question for users about which of their expectations hold when an upgrade path exists above the wallet.
3. A second freeze after the April precedent
The October 30 move was not the first of its kind. In April, the council announced that it had moved more than 30,765 ETH held by the exploiter behind the KelpDAO incident on Arbitrum One. That earlier action established that the council was willing to use its emergency authority against funds it judged to be stolen.
Steven Goldfeder, co-founder and chief executive of Offchain Labs, the company that develops Arbitrum, addressed the April freeze in a July podcast appearance. He said the council's role in that case was by design. In his description, the power rests with an external, broadly elected entity rather than with him personally, which is the framing the network's builders use when asked who can intervene.
Two such actions in a single year turn what might have been a theoretical capability into an established practice, and that is why the mechanics matter to anyone holding assets on the network.
4. How could the council move funds without the owner's key?
Ordinarily, a transfer from a wallet requires a signature produced by the wallet's private key. The Zealynx walkthrough explains that the council did not need one, because it controls the contract path through which messages enter Arbitrum from Ethereum.
According to the analysis, the council's multisignature wallet, a Safe that currently requires nine of its twelve signers, called Arbitrum's UpgradeExecutor in a single Ethereum transaction at block 26301886. For a brief moment the executor ran the network's Inbox contract on override code. That code recorded the target address, without the usual address translation, as the sender of the message. Once the transfers were queued, the original Inbox code was put back.
The result is that the network treated the instruction as though it had come from the holder. The council repeated the procedure for each asset, sending the ARB first and then the ETH.
5. What the onchain data shows
A check of data on both Ethereum and Arbitrum One is consistent with the Zealynx account. The two messages executed on Arbitrum One 9 minutes and 45 seconds after the Ethereum transaction that triggered them.
Both appeared as type 0x65 transactions with signature fields set to zero, which is the technical signature of a transfer that was not signed by the account's own key. They consumed the address's nonces 2 and 3. The first moved the ARB to a holding address ending in 0DA0, and the second moved 8,425.99768 ETH to the same place.
The figures quoted in news coverage as about 8,426 ETH and the more exact 8,425.99768 ETH describe the same transfer at different levels of precision.
6. Why the transfers look ordinary to most tools
One consequence, according to Zealynx, is that token contracts and blockchain indexers record only a plain transfer that the holder seems to have made. A casual observer reviewing the history of the address would not see anything that flags an intervention.
The distinguishing marks sit lower in the stack. On Arbitrum One, the 0x65 transaction type and the blank signature are the clues that separate a council-forced movement from an ordinary signed one. Anyone building monitoring tools, compliance software or accounting systems that read the chain would need to look for those markers specifically if they wanted to detect such interventions.
For users, the practical point is that a wallet history can show an outgoing transfer that the owner never authorized, and the usual explanation of a stolen key does not apply.
7. Why are the funds frozen, and what happens next?
The council's notice states that the funds can be moved again only through a vote of ArbitrumDAO governance, coordinated with the relevant parties. The notice also says that no other users' funds or applications were affected by the action.
That sets up the next stage. Token holders who take part in ArbitrumDAO would have to decide what becomes of the roughly 8,426 ETH and the 74.6 million ARB now sitting in the holding address. The article reporting the walkthrough did not give a date for any such vote, and none has been announced in the material available.
The freeze followed within hours of the draining of Binance's hot wallets. Binance has put the loss at about $6.3 billion, and a separate attribution by the blockchain analytics firm TRM has pointed to North Korea.
8. How this differs from a conventional theft
In a typical theft, an attacker obtains a private key or tricks a user into signing a malicious approval, and the signature on each transaction proves that the key was used. In this case the signature field is empty, and the authority comes from the contract layer instead. That is a different category of event, even though the visible effect, assets leaving a wallet, is the same.
The distinction also affects how the event is described. The council did not break into the address or exploit a bug; it exercised an authority that the DAO granted it, within the system's rules, and it announced the action afterward. Zealynx's point is that readers should understand this as a feature of the permission structure and not as a vulnerability waiting to be patched.
For developers of applications that integrate with Arbitrum, the lesson is to read the permission model of the network they build on. Guarantees that sound absolute, such as only the key holder can move the funds, are conditional on who controls upgrades, and those conditions are written into public contracts that anyone can inspect.
9. A power granted by the DAO, not a bug
Zealynx says it sees no flaw in the design. In its reading, the council used powers that the DAO had granted it and published both of its actions within about 90 minutes, which fits the transparency expectations attached to an emergency body.
Its broader message is aimed at developers and users. If a specification promises that only a key can move a wallet, the promise holds only up to the point where someone controls the upgrade path. On Arbitrum One, that path is held by two parties: the council's emergency Safe and the DAO's timelock on the Ethereum side.
This distinction is familiar from other networks that rely on upgradeable contracts. Self-custody guarantees describe what a key can do; they do not describe what the operators of an upgradeable system can do around it.
10. What the freeze means for holders on Arbitrum
For people who keep assets on Arbitrum, the episode clarifies the trade-off. An emergency council can interrupt the flow of stolen funds quickly, which is valuable when a theft as large as the Binance exploit is in progress. The same capability is also, by its nature, a form of control over wallets that their owners cannot veto.
The safeguards named so far are procedural. The council acts through a multisignature wallet with a nine-of-twelve threshold, it publishes notices describing what it did, and recovered or frozen funds can be released only by a DAO vote. Whether those checks are sufficient is a judgment each user has to make, but the Zealynx walkthrough lets that judgment rest on the actual mechanism rather than on assumption.
The next decision to watch is the DAO governance process over the frozen assets, which the council's own notice says is the only route to moving them.