Skip to main content
Uruguay Can

News from across crypto

Arbitrum council moves $30 million tied to Binance exploit

Arbitrum’s Security Council moved 8,425 ETH and 74.6 million ARB tied to the Binance exploit into a holding address, where a DAO vote must decide their next move.

Uruguay Can Editorial

Arbitrum council moves $30 million tied to Binance exploit

Arbitrum funds ordinarily move with the wallet holder’s signature; on Oct. 30, its Security Council moved 8,425 ETH and 74,559,805.2 ARB from an address linked to the Binance exploit without the attacker’s key. CoinDesk reported the assets were worth about $30 million.

The council’s emergency action notice says the funds are now at a holding address ending in 0DA0. For you, the unusual part is how the transfer happened: the council temporarily changed a core contract so it could act as if a transaction came from the exploit-linked address.

How did the council move funds without the key?

It used an emergency upgrade to Arbitrum’s Inbox contract, which carries messages from Ethereum into Arbitrum One. CoinDesk’s report on the transfer describes a temporary code change that added a function called sendUnsignedTransactionOverride. The council then:

  1. Upgraded the Inbox contract on Ethereum to add the function.
  2. Created two cross-chain transactions that treated the exploit-linked address as the sender and transferred its ETH and ARB to the holding address.
  3. Restored the Inbox contract to its original implementation.

Arbitrum’s notice says contributors prepared the transaction payload and the council verified it before signing and executing the action. It also says no other user’s funds or applications were affected.

Who can move the funds now?

The funds can only be moved through an ArbitrumDAO governance vote, according to the council’s notice. That puts the next decision with the DAO and means the emergency transfer did not itself return the assets to Binance or affected users. The notice says any vote will be coordinated with relevant parties.

The action shows that Arbitrum’s upgrade mechanism can override the normal expectation that only a wallet’s key holder can authorize spending from its address. The council says it used its emergency process to freeze funds tied to the exploit; the assets remain held pending the DAO’s decision.

Sources