Arbitrum Security Council Moves $30 Million From Binance Hack Address
The emergency move shows how far Arbitrum’s Security Council can go during an exploit, while the moved ETH and ARB are now locked until a DAO vote.
Key Takeaways
- Arbitrum’s Security Council moved more than 8,425 ETH and 74 million ARB on Friday from an address linked to the Binance hack.
- The council used emergency powers to temporarily change the code of the Inbox contracts and carry out two transactions without the hacker’s cooperation.
- According to the council and Zealynx, no other user funds or applications were affected, and the assets can only move further through an ArbitrumDAO vote.
Arbitrum’s Security Council moved more than 8,425 ETH and 74 million ARB on Friday from an address linked to the Binance hack, without the hacker having to do anything. At current prices, that is about $30 million (€26.7 million), far less than the roughly $6.3 billion (€5.6 billion) stolen in the attack on Binance.
How the council stepped in
Arbitrum is a network built on top of Ethereum that is meant to make transactions cheaper and handles billions of dollars in user deposits. Normally, funds on a blockchain can only move if the private key for the address signs a transaction. In this case, the Security Council used its emergency powers to temporarily change the code of the Inbox contracts, the part that forwards messages from Ethereum to Arbitrum.
The council has 12 members who are elected by holders of the ARB token. If nine members agree, they can carry out upgrades in emergencies. On Friday, the council deployed replacement code with a function that let transactions go through as if they came from the exploiter’s address. After that, two transactions were executed and the original code was restored in the same action.
What exactly happened
According to the council’s post on the governance forum, the ARB and ether were sent to an intermediate address ending in 0DA0. The council said that no other user funds or applications were affected. The moved assets can now only be moved through a governance vote by ArbitrumDAO, which is being coordinated with the parties involved.
Security firm Zealynx reported that the funds arrived on Arbitrum about 10 minutes after the Ethereum transaction, as type 0x65 transactions with empty signature fields. The company also pointed out that the council used its powers and made both steps public within an hour and a half. That highlights an important point for users: whoever controls the upgrade path can, in emergencies, do more than just fix a contract.
Why this matters
The move shows how far a DAO’s emergency powers can reach, especially for a network that presents itself as decentralized. Arbitrum has long used a model of gradual decentralization, where central control is supposed to shrink step by step. At the same time, the Security Council remains an important link, precisely because it can step in quickly during crises.
This is not the first time the council has acted like this. In April, Arbitrum already moved 30,766 ETH from the KelpDAO exploiter, then worth about $71 million (€63.3 million). That money stayed locked for weeks before a court adjustment and a DAO vote cleared the way for further steps. The FBI attributed the Binance hack on October 31 to the North Korean group TraderTraitor.