EN
Español
Português (Brasil)
Türkçe
Tiếng Việt
Bahasa Indonesia
Polski
Čeština
Română
Slovenčina
Magyar3 Nov 2026
Arbitrum's Security Council moved 8,425 ETH and 74.6 million ARB, roughly $30 million, out of an address tied to the Binance exploit without the attacker's signature. It briefly swapped the code of a core Arbitrum contract to do it. The funds now sit in a holding address that only an ArbitrumDAO vote can release, and the move reopens the debate over who really controls funds on layer 2 networks.
Exchanges TradeReviewed News Desk
The Arbitrum Security Council has moved about $30 million of funds linked to the Binance hack out of the attacker’s address, and it did so without ever holding the attacker’s private key. According to the council’s own notice on the Arbitrum governance forum, the emergency action on October 30 froze 8,425 ETH and 74,559,805.2 ARB that an address “identified with today’s Binance exploit” held on Arbitrum One.
Against a Binance loss the exchange has put at roughly $6.3 billion, $30 million is small. But how the money was moved matters more than how much, because it shows that on Arbitrum, an address can be made to spend without its owner signing anything.
How the Arbitrum Security Council moved the funds
The Security Council is a 12-member group elected by ARB token holders. It has emergency powers to upgrade Arbitrum’s contracts when at least nine members agree, and its shared Safe wallet needs nine signatures to act.
On October 30, at 8:08am Hong Kong time, that Safe sent one Ethereum transaction that did three things in a row, according to the council’s notice:
- It upgraded Arbitrum’s Inbox contract, the piece that carries messages from Ethereum into Arbitrum, to a version with a new function called
sendUnsignedTransactionOverride. - It used that function to send two cross-chain transactions that Arbitrum treated as coming from the exploiter’s address. One moved the ARB, the other moved the ETH, both to a holding address ending in
0DA0. - It switched the Inbox back to its original code in the same transaction.
Security firm Zealynx later traced the transactions in a walkthrough on the Ethereum Magicians forum. It found that both messages landed on Arbitrum One about ten minutes after the Ethereum transaction as type 0x65 transactions with blank signature fields, and that they used the address’s own next transaction counters (nonces 2 and 3). Unchained said its own read of the chain data matched that account, with a gap of 9 minutes and 45 seconds.
Two details stand out. First, the address had an EIP-7702 delegation on Arbitrum One, and it made no difference, because the transactions came from the address itself. Second, to the ARB token contract and to indexers, the move looks like a normal transfer the holder made. The only visible difference is the transaction type and the empty signature.
Not the first time this year
The council did the same thing in April, when it moved 30,766 ETH, then worth about $71 million, from the KelpDAO exploiter after law enforcement identified the attacker, CoinDesk reported. Getting that ether out of the holding address took weeks. Families holding unpaid terrorism judgments against North Korea tried to claim it, and a Manhattan federal judge had to modify a restraining notice before the DAO could vote to send it to Aave.
That history is relevant here. The FBI attributed the Binance hack to North Korea’s TraderTraitor group on October 31, so a similar legal fight over the frozen $30 million would not be a surprise. The council’s notice says the funds “can only be moved by an ArbitrumDAO Governance vote, which will be coordinated with relevant parties,” and that “no other user’s funds or applications were affected.”
For the wider picture of where the rest of the stolen money went, see our earlier reports on the $242 million laundered through Tron, THORChain and Relay and on how a THORChain halt slowed the Binance hackers.
Our analysis: recovery tool or decentralization problem?
There are two honest ways to read this. For victims, it is good news: a fast, published, multi-signature action pulled tens of millions away from a state-linked hacker before it could be bridged or swapped. Zealynx noted the council “used powers the DAO gave it and published both actions within an hour and a half.”
For anyone who treats Arbitrum as a place where only your key controls your coins, it is a reminder of a caveat that has always existed. As Zealynx put it, the assumption that an address only moves when its key signs holds “up to whoever controls the upgrade path.” Nine of twelve people, acting through a governance-approved process, can make any address on the network spend. That is not unique to Arbitrum, since many layer 2 networks and bridges still run on upgradable contracts with emergency councils, but it is now proven twice in one year.
There is also a quieter technical point. Because the forced transactions used the address’s next nonces, anything the holder had pre-signed for those nonces can no longer land. And tools that count an address’s transfers as its own actions, such as reputation scores or income records, would count this one too unless they check the transaction type.
What it means for traders
- Know the trust model. Funds on a layer 2 are only as final as its upgrade keys. Check whether a network has an emergency council, how many signers it needs and whether upgrades have a delay.
- Expect more freezes. After the Binance and Mercado Bitcoin hacks, chains, bridges and stablecoin issuers are acting faster. That makes stolen funds harder to move, but it also means any address can be targeted if it is flagged.
- Watch ARB governance. A DAO vote on what happens to the 74.6 million ARB and 8,425 ETH could take weeks, and legal claims may slow it down as they did in April.
- Choose your venue carefully. Exchange security still matters most for most traders. Our exchange comparison shows how platforms stack up, and our BingX review (our #1 pick) and OKX review (#2) cover security, reserves and withdrawals in detail.
Next to watch: the ArbitrumDAO proposal on the frozen funds, any court filings against them, and whether other networks used similar powers on Binance hack funds. This is not financial advice.
Follow TradeReviewed on X and Telegram: you hear crypto and trading news here first.
Related reviews
Sources
- Arbitrum governance forum: Security Council Emergency Action - 30/10/2026
- CoinDesk: Arbitrum's council moved $30 million of Binance hack funds without the hacker's key
- Ethereum Magicians (Zealynx): How Arbitrum's freezes send transactions from an address without its key
- Unchained: Arbitrum's Security Council Can Move a Wallet's Funds Without Its Key, Binance Freeze Shows
News is for information only and is not financial advice. More crypto news
You'll hear it here first
Get crypto news first on our Telegram channel.