Mentioned in This Article
1. Arcus exploit at a glance
The Arcus exploit cost the Robinhood Chain decentralized exchange 2,234,391 USDG, roughly $2.23 million, after a bug in subaccount transfers let a newly created account inflate its balance and withdraw funds it never deposited. The attack began around 10:07 p.m. ET on November 9, 2026. Arcus covered the shortfall from its company treasury, and no other users lost funds.
An on-chain rate limit on the exchange's bridge held back approximately $3 million in additional withdrawal requests from the same account. Those requests were reversed once Arcus deployed a fix, leaving the attacker with only the tokens that had already cleared before the platform intervened.
The incident stands out less for its size than for where the failure occurred. The weak point was not a smart contract but the exchange's internal accounting for movements between subaccounts, a layer of the system that is easy to treat as bookkeeping rather than as part of the security perimeter.
2. What is Arcus?
Arcus is a decentralized exchange linked to the team behind dYdX, one of the longest-running names in on-chain derivatives trading. It operates on Robinhood Chain and settles payouts in USDG, the dollar-pegged stablecoin, through a contract called BridgeVault, which holds user deposits and processes withdrawals.
Stablecoins such as USDG are designed to track the U.S. dollar one-for-one, which is why the token count withdrawn in this incident translates closely into a dollar figure. Even so, the 2,234,391 USDG number describes how many tokens left the platform; it is not an independently audited measure of the attacker's profit or of Arcus's final economic loss.
Exchanges built for active traders commonly let users split their holdings into subaccounts, for example to separate strategies or manage margin. Moving funds between those subaccounts is routine, and the system that records each transfer has to keep every balance accurate to the last unit. In this case that record-keeping broke down.
3. How did the Arcus exploit work?
A newly created account exploited a flaw in the way Arcus processed transfers between subaccounts, causing the platform to record a balance far larger than the account had actually deposited. The account then withdrew against that inflated figure.
Arcus has not published the precise conditions that triggered the error. What is clear is that the platform's ledger treated the account as holding funds that did not exist, and the bridge honored withdrawals based on that ledger until other safeguards intervened.
Errors of this kind belong to a well-understood family of software bugs in which arithmetic on balances produces results that should be impossible, such as a figure that grows when it should shrink. They are widely documented and routinely tested for, which is part of why their appearance in a production system run by an experienced team has drawn attention.
The case also illustrates why security reviews in crypto increasingly look beyond on-chain code. Arcus's smart contracts were reportedly not the point of failure. Instead, the problem sat in the off-chain logic that decides what each account is owed, logic that a contract audit alone would not necessarily examine.
4. Timeline: from first transfer to restored withdrawals
The suspicious activity started at about 10:07 p.m. Eastern Time on November 9. Because Eastern Time runs five hours behind Coordinated Universal Time in November, the same events fell in the early hours of November 10 in UTC, which explains why some records date the incident to November 9 and others to November 10. Both refer to the same night.
Roughly three minutes in, at around 10:10 p.m. ET, the on-chain rate limit on the bridge engaged, capping how much could leave the platform. At 10:15 p.m. ET, Arcus's internal monitoring flagged the activity and an investigation began.
At 11:07 p.m. ET, Arcus paused withdrawals across the entire platform. A code fix went live about 30 minutes after the pause. Normal withdrawals resumed at 4:26 a.m. ET on November 10, a little over six hours after the first abnormal transfer.
The sequence shows two very different response speeds. The automated rate limit acted within minutes, while the manual decision to halt all withdrawals came close to an hour after monitoring first raised the alarm.
5. The rate limit that stopped another $3 million
Of everything that happened that night, the bridge rate limit had the largest effect on the final outcome. By restricting the pace of outflows, it left approximately $3 million in withdrawal requests from the attacking account sitting in a queue rather than completed.
Once the fix was deployed, those pending requests were reversed. Only the 2,234,391 USDG that had already cleared before the limit and the pause took effect stayed with the exploiter.
Rate limits work as a circuit breaker: they do not detect wrongdoing, but they cap how much damage can be done in a given window, buying time for people and monitoring systems to react. In this case the gap between the automated cap and the manual pause meant that the circuit breaker did most of the protective work. Without it, the roughly $3 million that was held back would likely have left the platform as well.
6. Arcus covers the shortfall from its treasury
Arcus said it made up the missing funds from its company treasury. No other users' balances were negatively affected, and the exchange was operating normally again within hours.
That choice matters for traders. When a platform suffers a loss, the shortfall can sometimes be spread across users, for example through reduced balances or socialized losses. By absorbing the hit directly, Arcus kept its customers whole and avoided turning one account's exploit into a platform-wide problem.
A treasury backstop of this kind depends on the operator having enough reserves on hand to absorb an unexpected loss. In this case, a shortfall of roughly $2.23 million was something Arcus could cover without passing the cost on, which helped restore normal service quickly. Covering the gap directly also removes a source of uncertainty for traders, who would otherwise have to wonder whether their own balances might be adjusted to make up the difference.
As of November 13, there were no reports of the incident spreading to other platforms or affecting the broader market. The damage appears confined to Arcus, which has taken the cost onto its own balance sheet.
7. Tracing the funds
Arcus has published the address of the wallet that received the withdrawn tokens and says it is working with blockchain investigators to trace where the funds go next.
Publishing an attacker's address is a common step after a crypto exploit. It allows exchanges, stablecoin issuers and analytics firms to flag incoming transfers from that wallet, which can make it harder to convert stolen tokens into other assets or cash without drawing scrutiny.
The incident has been characterized as an internal accounting error rather than a flaw in the exchange's smart contracts. That distinction does not change the size of the loss, but it does shape what Arcus and other platforms are likely to review as a result.
8. Why internal ledgers are part of the attack surface
Many trading platforms, including decentralized ones, combine on-chain settlement with internal ledgers that track activity between deposits and withdrawals. Recording trades, margin changes and subaccount transfers in an internal system allows faster, cheaper operations than settling every action on a blockchain, but it also means that the numbers in that system effectively decide who can withdraw what.
When a ledger is correct, the bridge or vault simply carries out instructions that reflect real balances. When the ledger is wrong, the same machinery faithfully pays out funds that should never have existed. In that sense, the internal accounting layer carries the same responsibility as the vault contract itself, even though it rarely receives the same public attention.
This is why defenses such as withdrawal rate limits, balance reconciliation checks and automated alerts matter even on platforms whose contracts have been reviewed. They act as independent checks that can catch a discrepancy between what the ledger says and what the vault actually holds, limiting losses when a bug slips through testing. The Arcus incident offers a concrete example of one such control, the bridge rate limit, sharply reducing the amount that could be taken.
9. Lessons for exchanges and traders
Two points stand out from the way the Arcus exploit unfolded. The first is timing. An automated control engaged about three minutes after the attack began, while the platform-wide pause took nearly an hour after the first alert. The contrast strengthens the case for building automated limits into withdrawal paths, since human decision-making, however quick, is slower than code.
The second is scope. Audits in crypto often concentrate on smart contracts because that is where many high-profile exploits have occurred. The Arcus case shows that the systems tracking internal balances, which can look like routine accounting, deserve the same scrutiny, because any error in them can be turned into real withdrawals.
For users, the most reassuring element is the treasury backstop. Customers were made whole, and the exchange was running again by early the next morning, a far better outcome than many exploits produce.
10. What comes next for Arcus
Several questions remain open. One is whether any of the withdrawn funds can be recovered as investigators follow the exploiter's wallet.
Another is whether Arcus will publish a fuller technical postmortem that explains exactly how the subaccount transfer bug arose and what new checks it has added to prevent a repeat.
A third is whether other trading venues on Robinhood Chain review their own bridge rate limits in light of the incident. The difference between a three-minute automated response and an hour-long manual pause is likely to feature prominently in those discussions.
Until a detailed report appears, traders and other platforms will be working from the timeline and figures Arcus has already shared, which point to a contained incident with a clear cause and a fix already in place.